N°8245 - External key not saved in n-n link in edition (#703 )

* N°8245 - External key not saved in n-n link in edition * Remove the listener from the input element itself, put it on the body with a selector that matches our input * Revert "N°8245 - External key not saved in n-n link in edition" This reverts commit a756f9b159. --------- Co-authored-by: Stephen Abello <stephen.abello@combodo.com>
Workaround for N°4459 doesn't work on 3.2
2026-02-24 04:44:10 +01:00 · 2025-03-24 14:05:30 +01:00 · 2025-03-24 11:21:41 +01:00 · 2025-03-24 11:02:34 +01:00 · 2025-03-24 10:53:18 +01:00 · 2025-03-24 10:52:47 +01:00
46 changed files with 1155 additions and 453 deletions
--- a/application/applicationextension.inc.php
+++ b/application/applicationextension.inc.php
@@ -1711,6 +1711,11 @@ interface iRestServiceProvider
 	public function ExecOperation($sVersion, $sVerb, $aParams);
 }

+interface iRestInputSanitizer
+{
+	public function SanitizeJsonInput(string $sJsonInput): string;
+}
+
 /**
 * Minimal REST response structure. Derive this structure to add response data and error codes.
 *
@@ -1802,6 +1807,14 @@ class RestResult
 	 * @api
 	 */
 	public $message;
+	
+	/**
+	 * Sanitize the content of this result to hide sensitive information
+	 */
+	public function SanitizeContent()
+	{
+		// The default implementation does nothing
+	}
 }

 /**
--- a/application/utils.inc.php
+++ b/application/utils.inc.php
@@ -419,11 +419,26 @@ class utils
 	 * @since 2.7.7, 3.0.2, 3.1.0 N°4899 - new 'url' filter
 	 * @since 2.7.10 N°6606 use the utils::ENUM_SANITIZATION_* const
 	 * @since 2.7.10 N°6606 new case for ENUM_SANITIZATION_FILTER_PHP_CLASS
+	 * @since 3.2.1-1 N°8242 Allow value to be an array for every filter
 	 *
 	 * @link https://www.php.net/manual/en/filter.filters.sanitize.php PHP sanitization filters
 	 */
 	protected static function Sanitize_Internal($value, $sSanitizationFilter)
 	{
+		if (is_array($value))
+		{
+			$retValue = array();
+			foreach ($value as $key => $val)
+			{
+				$retValue[$key] = self::Sanitize_Internal($val, $sSanitizationFilter); // recursively check arrays
+				if ($retValue[$key] === false)
+				{
+					return false;
+				}
+			}
+			return $retValue;
+		}
+
 		switch ($sSanitizationFilter)
 		{
 			case static::ENUM_SANITIZATION_FILTER_INTEGER:
@@ -454,52 +469,36 @@ class utils
 			case static::ENUM_SANITIZATION_FILTER_PARAMETER:
 			case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
 			case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
-				if (is_array($value))
+				switch ($sSanitizationFilter)
 				{
-					$retValue = array();
-					foreach ($value as $key => $val)
-					{
-						$retValue[$key] = self::Sanitize_Internal($val, $sSanitizationFilter); // recursively check arrays
-						if ($retValue[$key] === false)
-						{
-							$retValue = false;
-							break;
-						}
-					}
-				}
-				else
-				{
-					switch ($sSanitizationFilter)
-					{
-						case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
-							// Same as parameter type but keep the dot character
-							// transaction_id, the dot is mostly for Windows servers when using file storage as the tokens are named *.tmp
-							// - See N°1835
-							// - Note: It must be included at the regexp beginning otherwise you'll get an invalid character error
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\. A-Za-z0-9_=-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
+						// Same as parameter type but keep the dot character
+						// transaction_id, the dot is mostly for Windows servers when using file storage as the tokens are named *.tmp
+						// - See N°1835
+						// - Note: It must be included at the regexp beginning otherwise you'll get an invalid character error
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\. A-Za-z0-9_=-]*$/')));
+						break;

-						case static::ENUM_SANITIZATION_FILTER_ROUTE:
-						case static::ENUM_SANITIZATION_FILTER_OPERATION:
-							// - Routes should be of the "controller_namespace_code.controller_method_name" form
-							// - Operations should be allowed to be namespaced as well even though then don't have dedicated controller yet
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\.A-Za-z0-9_-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_ROUTE:
+					case static::ENUM_SANITIZATION_FILTER_OPERATION:
+						// - Routes should be of the "controller_namespace_code.controller_method_name" form
+						// - Operations should be allowed to be namespaced as well even though then don't have dedicated controller yet
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\.A-Za-z0-9_-]*$/')));
+						break;

-						case static::ENUM_SANITIZATION_FILTER_PARAMETER:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=-]*$/'))); // the '=', '%3D, '%2B', '%2F'
-							// Characters are used in serialized filters (starting 2.5, only the url encoded versions are presents, but the "=" is kept for BC)
-							break;
+					case static::ENUM_SANITIZATION_FILTER_PARAMETER:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=-]*$/'))); // the '=', '%3D, '%2B', '%2F'
+						// Characters are used in serialized filters (starting 2.5, only the url encoded versions are presents, but the "=" is kept for BC)
+						break;

-						case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[A-Za-z0-9_]+(->[A-Za-z0-9_]+)*$/'))); // att_code or att_code->name or AttCode->Name or AttCode->Key2->Name
-							break;
+					case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[A-Za-z0-9_]+(->[A-Za-z0-9_]+)*$/'))); // att_code or att_code->name or AttCode->Name or AttCode->Key2->Name
+						break;

-						case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=%:+-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=%:+-]*$/')));
+						break;

-					}
 				}
 				break;

--- a/core/attributedef.class.inc.php
+++ b/core/attributedef.class.inc.php
@@ -142,7 +142,7 @@ abstract class AttributeDefinition

 	protected $aCSSClasses;

-	public function GetType()
+    public function GetType()
 	{
 		return Dict::S('Core:'.get_class($this));
 	}
@@ -4193,7 +4193,7 @@ class AttributeFinalClass extends AttributeString
 */
 class AttributePassword extends AttributeString implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	/**
 	 * Useless constructor, but if not present PHP 7.4.0/7.4.1 is crashing :( (N°2329)
@@ -4270,7 +4270,7 @@ class AttributePassword extends AttributeString implements iAttributeNoGroupBy
 */
 class AttributeEncryptedString extends AttributeString implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	protected function GetSQLCol($bFullSpec = false)
 	{
@@ -6346,7 +6346,15 @@ class AttributeDateTime extends AttributeDBField

 		$oFormField = parent::MakeFormField($oObject, $oFormField);

-		return $oFormField;
+        // After call to the parent as it sets the current value
+        $oValue = $oObject->Get($this->GetCode());
+        if ($oValue === $this->GetNullValue()) {
+            $oValue = $this->GetDefaultValue($oObject);
+        }
+        $oFormField->SetCurrentValue($this->GetFormat()->Format($oValue));
+
+
+        return $oFormField;
 	}

 	/**
@@ -10004,7 +10012,7 @@ class AttributeSubItem extends AttributeDefinition
 */
 class AttributeOneWayPassword extends AttributeDefinition implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	/**
 	 * Useless constructor, but if not present PHP 7.4.0/7.4.1 is crashing :( (N°2329)
--- a/core/restservices.class.inc.php
+++ b/core/restservices.class.inc.php
@@ -44,6 +44,8 @@ class ObjectResult
 	 * @var string
 	 * @api
 	 */
+    use SanitizeTrait;
+
 	public $message;
 	/**
 	 * @var mixed|null
@@ -156,6 +158,19 @@ class ObjectResult
 	{
 		$this->fields[$sAttCode] = $this->MakeResultValue($oObject, $sAttCode, $bExtendedOutput);
 	}
+
+public function SanitizeContent()
+	{
+		foreach($this->fields as $sFieldAttCode => $fieldValue)
+		{
+            try {
+			$oAttDef = MetaModel::GetAttributeDef($this->class, $sFieldAttCode);
+            } catch (Exception $e) { // for special cases like ID
+                continue;
+            }
+                $this->SanitizeFieldIfSensitive($this->fields, $sFieldAttCode, $fieldValue, $oAttDef);
+		}
+	}
 }


@@ -221,6 +236,16 @@ class RestResultWithObjects extends RestResult
 		$sObjKey = get_class($oObject).'::'.$oObject->GetKey();
 		$this->objects[$sObjKey] = $oObjRes;
 	}
+
+public function SanitizeContent()
+	{
+		parent::SanitizeContent();
+
+		foreach($this->objects as $sObjKey => $oObjRes)
+		{
+			$oObjRes->SanitizeContent();
+		}
+	}
 }

 /**
@@ -308,9 +333,10 @@ class RestDelete
 *
 * @package     Core
 */
-class CoreServices implements iRestServiceProvider
+class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 {
-	/**
+    use SanitizeTrait;
+    /**
 	 * Enumerate services delivered by this class
 	 * 	 
 	 * @param string $sVersion The version (e.g. 1.0) supported by the services
@@ -528,18 +554,18 @@ class CoreServices implements iRestServiceProvider
            }
 			else
 			{
-                                if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*') 
+                                if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*')
                                {
                                        $aFields = $aShowFields[$sClass];
                                        //Id is not a valid attribute to optimize
-                                        if (in_array('id', $aFields)) 
+                                        if (in_array('id', $aFields))
                                        {
                                            unset($aFields[array_search('id', $aFields)]);
                                        }
                                        $aAttToLoad = array($oObjectSet->GetClassAlias() => $aFields);
                                        $oObjectSet->OptimizeColumnLoad($aAttToLoad);
                                }
-                                
+
 				while ($oObject = $oObjectSet->Fetch())
 				{
 					$oResult->AddObject(0, '', $oObject, $aShowFields, $bExtendedOutput);
@@ -737,6 +763,33 @@ class CoreServices implements iRestServiceProvider
 		return $oResult;
 	}

+	public function SanitizeJsonInput(string $sJsonInput): string
+	{
+        $sSanitizedJsonInput = $sJsonInput;
+        $aJsonData = json_decode($sSanitizedJsonInput, true);
+        $sOperation = $aJsonData['operation'];
+
+        switch ($sOperation) {
+            case 'core/check_credentials':
+                if (isset($aJsonData['password'])) {
+                    $aJsonData['password'] = '*****';
+                }
+                break;
+            case 'core/update':
+            case 'core/create':
+            default :
+            $sClass = $aJsonData['class'];
+            if (isset($aJsonData['fields'])) {
+                foreach ($aJsonData['fields'] as $sFieldAttCode => $fieldValue) {
+                    $oAttDef = MetaModel::GetAttributeDef($sClass, $sFieldAttCode);
+                    $this->SanitizeFieldIfSensitive($aJsonData['fields'], $sFieldAttCode, $fieldValue, $oAttDef);
+                }
+            }
+            break;
+        }
+		return json_encode($aJsonData, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE);
+	}
+
 	/**
 	 * Helper for object deletion	
 	 */
@@ -875,3 +928,50 @@ class CoreServices implements iRestServiceProvider
 		return $iLimit * max(0, $iPage - 1);
 	}
 }
+
+trait SanitizeTrait
+{
+    /**
+     * Sanitize a field if it is sensitive.
+     *
+     * @param array $fields The fields array
+     * @param string $sFieldAttCode The attribute code
+     * @param mixed $oAttDef The attribute definition
+     * @throws Exception
+     */
+    private function SanitizeFieldIfSensitive(array &$fields, string $sFieldAttCode, $fieldValue, $oAttDef): void
+    {
+        // for simple attribute
+        if ($oAttDef instanceof iAttributeNoGroupBy) // iAttributeNoGroupBy is equivalent to sensitive attribute
+        {
+            $fields[$sFieldAttCode] = '*****';
+            return;
+        }
+        // for 1-n / n-n relation
+        if ($oAttDef instanceof AttributeLinkedSet) {
+            foreach ($fieldValue as $i => $aLnkValues) {
+                foreach ($aLnkValues as $sLnkAttCode => $sLnkValue) {
+                    $oLnkAttDef = MetaModel::GetAttributeDef($oAttDef->GetLinkedClass(), $sLnkAttCode);
+                    if ($oLnkAttDef instanceof iAttributeNoGroupBy) { // 1-n relation
+                        $fields[$sFieldAttCode][$i][$sLnkAttCode] = '*****';
+                    }
+                    elseif ($oAttDef instanceof AttributeLinkedSetIndirect && $oLnkAttDef instanceof AttributeExternalField) { // for n-n relation
+                        $oExtKeyAttDef = MetaModel::GetAttributeDef($oLnkAttDef->GetTargetClass(), $oLnkAttDef->GetExtAttCode());
+                        if ($oExtKeyAttDef instanceof iAttributeNoGroupBy) {
+                            $fields[$sFieldAttCode][$i][$sLnkAttCode] = '*****';
+                        }
+                    }
+                }
+            }
+            return;
+        }
+
+        // for external attribute
+        if ($oAttDef instanceof AttributeExternalField) {
+            $oExtKeyAttDef = MetaModel::GetAttributeDef($oAttDef->GetTargetClass(), $oAttDef->GetExtAttCode());
+            if ($oExtKeyAttDef instanceof iAttributeNoGroupBy) {
+                $fields[$sFieldAttCode] = '*****';
+            }
+        }
+    }
+}
--- a/datamodels/2.x/authent-cas/composer.json
+++ b/datamodels/2.x/authent-cas/composer.json
@@ -1,4 +1,5 @@
 {
+  "name": "combodo/authent-cas",
  "config" : {
    "classmap-authoritative" : true
  },
--- a/datamodels/2.x/authent-cas/composer.lock
+++ b/datamodels/2.x/authent-cas/composer.lock
@@ -4,15 +4,15 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "d751713988987e9331980363e24189ce",
+    "content-hash": "2f342cfe65023402c1e00d88698d52b9",
    "packages": [],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
    "prefer-stable": false,
    "prefer-lowest": false,
-    "platform": [],
-    "platform-dev": [],
-    "plugin-api-version": "2.1.0"
+    "platform": {},
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
 }
--- a/datamodels/2.x/authent-cas/vendor/autoload.php
+++ b/datamodels/2.x/authent-cas/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0::getLoader();
+return ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9::getLoader();
--- a/datamodels/2.x/authent-cas/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/authent-cas/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/InstalledVersions.php
@@ -21,11 +21,31 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
+    /**
+     * @var mixed[]|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
+     */
    private static $installed;
+
+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
+    /**
+     * @var bool|null
+     */
    private static $canGetVendors;
+
+    /**
+     * @var array[]
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
+     */
    private static $installedByVendor = array();

    /**
@@ -83,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -104,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -228,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -242,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -265,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -288,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -307,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -325,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0
+class ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0
+class ComposerStaticInit2f342cfe65023402c1e00d88698d52b9
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -31,9 +31,9 @@ class ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/authent-cas/vendor/composer/installed.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/authent-cas',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
        'type' => 'library',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => '5a1627632aa2e605996c1c556c60c2a2cddc0a05',
-        'name' => '__root__',
        'dev' => true,
    ),
    'versions' => array(
-        '__root__' => array(
+        'combodo/authent-cas' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
            'type' => 'library',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => '5a1627632aa2e605996c1c556c60c2a2cddc0a05',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-attachments/composer.json
+++ b/datamodels/2.x/itop-attachments/composer.json
@@ -1,4 +1,5 @@
 {
+  "name": "combodo/itop-attachments",
  "config" : {
    "classmap-authoritative" : true
  },
--- a/datamodels/2.x/itop-attachments/composer.lock
+++ b/datamodels/2.x/itop-attachments/composer.lock
@@ -4,15 +4,15 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "d751713988987e9331980363e24189ce",
+    "content-hash": "ee10bebff75617dbf9d929ac6e40c19f",
    "packages": [],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
    "prefer-stable": false,
    "prefer-lowest": false,
-    "platform": [],
-    "platform-dev": [],
-    "plugin-api-version": "2.1.0"
+    "platform": {},
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
 }
--- a/datamodels/2.x/itop-attachments/vendor/autoload.php
+++ b/datamodels/2.x/itop-attachments/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50::getLoader();
+return ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f::getLoader();
--- a/datamodels/2.x/itop-attachments/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/itop-attachments/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/InstalledVersions.php
@@ -21,15 +21,22 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
    /**
     * @var mixed[]|null
-     * @psalm-var array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}|array{}|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
     */
    private static $installed;

+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
    /**
     * @var bool|null
     */
@@ -37,7 +44,7 @@ class InstalledVersions

    /**
     * @var array[]
-     * @psalm-var array<string, array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static $installedByVendor = array();

@@ -96,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -117,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -241,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -255,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -278,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -301,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -320,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -338,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50
+class ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50
+class ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -28,9 +28,9 @@ class ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/itop-attachments/vendor/composer/installed.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/itop-attachments',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => 'd9ea2d27026782c29be93eb9d14ebb636e8e2484',
        'type' => 'library',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => 'cd585f68391ccb113ec98bf911ff6b5ebf979d8b',
-        'name' => '__root__',
        'dev' => true,
    ),
    'versions' => array(
-        '__root__' => array(
+        'combodo/itop-attachments' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => 'd9ea2d27026782c29be93eb9d14ebb636e8e2484',
            'type' => 'library',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => 'cd585f68391ccb113ec98bf911ff6b5ebf979d8b',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-oauth-client/vendor/autoload.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074::getLoader();
+return ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce::getLoader();
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/InstalledVersions.php
@@ -21,11 +21,31 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
+    /**
+     * @var mixed[]|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
+     */
    private static $installed;
+
+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
+    /**
+     * @var bool|null
+     */
    private static $canGetVendors;
+
+    /**
+     * @var array[]
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
+     */
    private static $installedByVendor = array();

    /**
@@ -83,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -104,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -228,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -242,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -265,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -288,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -307,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -325,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074
+class ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInitd52424b43ff18219f2ec935428aff074::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInit285a4d33f818950c151bb893193d2cce::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInitd52424b43ff18219f2ec935428aff074
+class ComposerStaticInit285a4d33f818950c151bb893193d2cce
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -31,9 +31,9 @@ class ComposerStaticInitd52424b43ff18219f2ec935428aff074
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/installed.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/itop-oauth-client',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
        'type' => 'itop-extension',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => '8db89c3d5f5f88d80780db8acb5147ba0d95c42f',
-        'name' => 'combodo/itop-oauth-client',
        'dev' => true,
    ),
    'versions' => array(
        'combodo/itop-oauth-client' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
            'type' => 'itop-extension',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => '8db89c3d5f5f88d80780db8acb5147ba0d95c42f',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-portal-base/portal/composer.json
+++ b/datamodels/2.x/itop-portal-base/portal/composer.json
@@ -1,5 +1,8 @@
 {
-	"license": "AGPLv3",
+  "license": "AGPLv3",
+  "config" : {
+    "autoloader-suffix": "Combodo_ItopPortalBase_Portal"
+  },
 	"autoload": {
 		"psr-4": {
 			"Combodo\\iTop\\Portal\\": "src/"
--- a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
@@ -1238,15 +1238,17 @@ class ObjectFormManager extends FormManager

 		foreach ($aCurrentValues as $sAttCode => $value)
 		{
-			if (!array_key_exists($sAttCode, $this->aFieldsAtts)) {
-				continue;
-			}
-			$iAttributeFlags = $this->aFieldsAtts[$sAttCode];
-			if ($iAttributeFlags & OPT_ATT_HIDDEN) {
-				continue;
-			}
-			if ($iAttributeFlags & OPT_ATT_READONLY) {
-				continue;
+			if (count($this->aFieldsAtts) !== 0) {
+				if (!array_key_exists($sAttCode, $this->aFieldsAtts)) {
+					continue;
+				}
+				$iAttributeFlags = $this->aFieldsAtts[$sAttCode];
+				if ($iAttributeFlags & OPT_ATT_HIDDEN) {
+					continue;
+				}
+				if ($iAttributeFlags & OPT_ATT_READONLY) {
+					continue;
+				}
 			}

 			if (MetaModel::IsValidAttCode($sObjectClass, $sAttCode)) {
@@ -1399,55 +1401,56 @@ class ObjectFormManager extends FormManager
 		$this->aFieldsAtts = array();
 		$this->aExtraData = array();
 		$aFieldsDMOnlyAttCodes = array();
-		switch ($this->aFormProperties['type']) {
-			case 'custom_list':
-			case 'static':
-				foreach ($this->aFormProperties['fields'] as $sAttCode => $aOptions) {
-					// When in a transition and no flags are specified for the field, we will retrieve its flags from DM later
-					if ($this->IsTransitionForm() && empty($aOptions)) {
-						$aFieldsDMOnlyAttCodes[] = $sAttCode;
-						continue;
-					}
+		if (array_key_exists('type', $this->aFormProperties)) {
+			switch ($this->aFormProperties['type']) {
+				case 'custom_list':
+				case 'static':
+					foreach ($this->aFormProperties['fields'] as $sAttCode => $aOptions) {
+						// When in a transition and no flags are specified for the field, we will retrieve its flags from DM later
+						if ($this->IsTransitionForm() && empty($aOptions)) {
+							$aFieldsDMOnlyAttCodes[] = $sAttCode;
+							continue;
+						}

-					// Otherwise we proceed as usual
-					$iFieldFlags = OPT_ATT_NORMAL;
-					// Checking if field should be slave
-					if (isset($aOptions['slave']) && ($aOptions['slave'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_SLAVE;
+						// Otherwise we proceed as usual
+						$iFieldFlags = OPT_ATT_NORMAL;
+						// Checking if field should be slave
+						if (isset($aOptions['slave']) && ($aOptions['slave'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_SLAVE;
+						}
+						// Checking if field should be must_change
+						if (isset($aOptions['must_change']) && ($aOptions['must_change'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTCHANGE;
+						}
+						// Checking if field should be must prompt
+						if (isset($aOptions['must_prompt']) && ($aOptions['must_prompt'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTPROMPT;
+						}
+						// Checking if field should be hidden
+						if (isset($aOptions['hidden']) && ($aOptions['hidden'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_HIDDEN;
+						}
+						// Checking if field should be readonly
+						if (isset($aOptions['read_only']) && ($aOptions['read_only'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_READONLY;
+						}
+						// Checking if field should be mandatory
+						if (isset($aOptions['mandatory']) && ($aOptions['mandatory'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MANDATORY;
+						}
+						// Finally, adding the attribute and its flags
+						$this->aFieldsAtts[$sAttCode] = $iFieldFlags;
 					}
-					// Checking if field should be must_change
-					if (isset($aOptions['must_change']) && ($aOptions['must_change'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTCHANGE;
-					}
-					// Checking if field should be must prompt
-					if (isset($aOptions['must_prompt']) && ($aOptions['must_prompt'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTPROMPT;
-					}
-					// Checking if field should be hidden
-					if (isset($aOptions['hidden']) && ($aOptions['hidden'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_HIDDEN;
-					}
-					// Checking if field should be readonly
-					if (isset($aOptions['read_only']) && ($aOptions['read_only'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_READONLY;
-					}
-					// Checking if field should be mandatory
-					if (isset($aOptions['mandatory']) && ($aOptions['mandatory'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MANDATORY;
-					}
-					// Finally, adding the attribute and its flags
-					$this->aFieldsAtts[$sAttCode] = $iFieldFlags;
-				}
-				break;
+					break;

-			case 'zlist':
-				foreach (MetaModel::FlattenZList(MetaModel::GetZListItems($sObjectClass, $this->aFormProperties['fields'])) as $sAttCode) {
-					$this->aFieldsAtts[$sAttCode] = OPT_ATT_NORMAL;
-				}
-				break;
+				case 'zlist':
+					foreach (MetaModel::FlattenZList(MetaModel::GetZListItems($sObjectClass, $this->aFormProperties['fields'])) as $sAttCode) {
+						$this->aFieldsAtts[$sAttCode] = OPT_ATT_NORMAL;
+					}
+					break;
+			}
 		}
-
-		if ($this->aFormProperties['layout'] !== null) {
+		if (isset($this->aFormProperties['layout'])) {
 			$oXPath = new DOMXPath($this->oHtmlDocument);
 			/** @var \DOMElement $oFieldNode */
 			foreach ($oXPath->query('//div[contains(@class, "form_field")][@data-field-id]') as $oFieldNode) {
@@ -1510,7 +1513,7 @@ class ObjectFormManager extends FormManager
 		// Also, retrieving mandatory attributes from metamodel to be able to complete the form with them if necessary
 		//
 		// Note: When in a transition, we don't do this for fields that should be set from DM
-		if ($this->aFormProperties['type'] !== 'static') {
+		if (array_key_exists('type', $this->aFormProperties) && $this->aFormProperties['type'] !== 'static') {
 			if ($this->IsTransitionForm()) {
 				$aDatamodelAttCodes = $this->oObject->GetTransitionAttributes($this->aFormProperties['stimulus_code']);
 			}
@@ -1616,7 +1619,7 @@ class ObjectFormManager extends FormManager
 		}

 		$this->oHtmlDocument = new DOMDocument();
-		if ($this->aFormProperties['layout'] !== null) {
+		if (isset($this->aFormProperties['layout'])) {
 			// Checking if we need to render the template from twig to html in order to parse the fields
 			if ($this->aFormProperties['layout']['type'] === 'twig') {
 				if ($this->oFormHandlerHelper !== null) {
--- a/datamodels/2.x/itop-portal-base/portal/vendor/autoload.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/autoload.php
@@ -22,4 +22,4 @@ if (PHP_VERSION_ID < 50600) {

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInitd751713988987e9331980363e24189ce::getLoader();
+return ComposerAutoloaderInitCombodo_ItopPortalBase_Portal::getLoader();
--- a/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInitd751713988987e9331980363e24189ce
+class ComposerAutoloaderInitCombodo_ItopPortalBase_Portal
 {
    private static $loader;

@@ -22,13 +22,14 @@ class ComposerAutoloaderInitd751713988987e9331980363e24189ce
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInitd751713988987e9331980363e24189ce', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitCombodo_ItopPortalBase_Portal', 'loadClassLoader'), true, true);
        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInitd751713988987e9331980363e24189ce', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitCombodo_ItopPortalBase_Portal', 'loadClassLoader'));

        require __DIR__ . '/autoload_static.php';
-        call_user_func(\Composer\Autoload\ComposerStaticInitd751713988987e9331980363e24189ce::getInitializer($loader));
+        call_user_func(\Composer\Autoload\ComposerStaticInitCombodo_ItopPortalBase_Portal::getInitializer($loader));

+        $loader->setClassMapAuthoritative(true);
        $loader->register(true);

        return $loader;
--- a/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInitd751713988987e9331980363e24189ce
+class ComposerStaticInitCombodo_ItopPortalBase_Portal
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -103,9 +103,9 @@ class ComposerStaticInitd751713988987e9331980363e24189ce
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitd751713988987e9331980363e24189ce::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitd751713988987e9331980363e24189ce::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInitd751713988987e9331980363e24189ce::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitCombodo_ItopPortalBase_Portal::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitCombodo_ItopPortalBase_Portal::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitCombodo_ItopPortalBase_Portal::$classMap;

        }, null, ClassLoader::class);
    }
--- a/js/links/links_widget.js
+++ b/js/links/links_widget.js
@@ -390,16 +390,17 @@ function LinksWidget(id, sClass, sAttCode, iInputId, sSuffix, bDuplicates, oWizH

 	this.RegisterChange = function () {
 		// Listen only used inputs
-		$('#linkedset_'+me.id+' :input[name^="attr_'+me.sAttCode+'["]').off('change').on('change', function () {
+		$('body').off('change', '#linkedset_'+me.id+' :input[name^="attr_'+me.sAttCode+'["]')
+			.on('change', '#linkedset_'+me.id+' :input[name^="attr_'+me.sAttCode+'["]', function () {
 			if (!($(this).hasClass('selection')))
-			{
-				let oCheckbox = $(this).closest('tr').find('.selection');
-				let iLink = oCheckbox.attr('data-link-id');
-				let iUniqueId = oCheckbox.attr('data-unique-id');
-				let sAttCode = $(this).closest('.attribute-edit').attr('data-attcode');
-				let value = $(this).val();;
-				return me.OnValueChange(iLink, iUniqueId, sAttCode, value, this);
-			}
+				{
+					let oCheckbox = $(this).closest('tr').find('.selection');
+					let iLink = oCheckbox.attr('data-link-id');
+					let iUniqueId = oCheckbox.attr('data-unique-id');
+					let sAttCode = $(this).closest('.attribute-edit').attr('data-attcode');
+					let value = $(this).val();;
+					return me.OnValueChange(iLink, iUniqueId, sAttCode, value, this);
+				}
 			return true;
 		});
 	};
--- a/tests/php-unit-tests/src/BaseTestCase/ItopTestCase.php
+++ b/tests/php-unit-tests/src/BaseTestCase/ItopTestCase.php
@@ -9,7 +9,7 @@ namespace Combodo\iTop\Test\UnitTest;
 use CMDBSource;
 use DeprecatedCallsLog;
 use MySQLTransactionNotClosedException;
-use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use ReflectionMethod;
 use SetupUtils;
 use Symfony\Component\HttpKernel\KernelInterface;
@@ -23,7 +23,7 @@ use const DEBUG_BACKTRACE_IGNORE_ARGS;
 *
 * @since 3.0.4 3.1.1 3.2.0 N°6658 move some setUp/tearDown code to the corresponding methods *BeforeClass to speed up tests process time.
 */
-abstract class ItopTestCase extends TestCase
+abstract class ItopTestCase extends KernelTestCase
 {
 	public const TEST_LOG_DIR = 'test';

--- a/tests/php-unit-tests/unitary-tests/core/Delta/delta_test_sanitize_output.xml
+++ b/tests/php-unit-tests/unitary-tests/core/Delta/delta_test_sanitize_output.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<itop_design xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.7">
+  <classes>
+    <class id="TestServer" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>test_server</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="contact_list" xsi:type="AttributeLinkedSetIndirect">
+          <linked_class>lnkContactTestToServer</linked_class>
+          <ext_key_to_me>test_server_id</ext_key_to_me>
+          <ext_key_to_remote>contact_test_id</ext_key_to_remote>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+        <field id="password_list" xsi:type="AttributeLinkedSet">
+          <linked_class>PasswordTest</linked_class>
+          <ext_key_to_me>server_test_id</ext_key_to_me>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+        <field id="name" xsi:type="AttributeString">
+          <sql>name</sql>
+          <default_value/>
+          <is_null_allowed>false</is_null_allowed>
+        </field>
+      </fields>
+    </class>
+
+
+    <class id="ContactTest" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>contact_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="password" xsi:type="AttributeEncryptedString">
+          <sql>password</sql>
+        </field>
+        <field id="server_test_list" xsi:type="AttributeLinkedSetIndirect">
+          <linked_class>lnkContactTestToServer</linked_class>
+          <ext_key_to_me>contact_test_id</ext_key_to_me>
+          <ext_key_to_remote>test_server_id</ext_key_to_remote>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+      </fields>
+    </class>
+
+
+    <class id="lnkContactTestToServer" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>lnk_contact_server_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="contact_test_password" xsi:type="AttributeExternalField" _delta="define">
+          <extkey_attcode>contact_test_id</extkey_attcode>
+          <target_attcode>password</target_attcode>
+        </field>
+        <field id="test_server_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>TestServer</target_class>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+          <sql>test_server</sql>
+          <is_null_allowed>false</is_null_allowed>
+
+        </field>
+        <field id="contact_test_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>ContactTest</target_class>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+          <sql>contact_test</sql>
+          <is_null_allowed>false</is_null_allowed>
+
+        </field>
+      </fields>
+    </class>
+    <class id="PasswordTest" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>password_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="server_test_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>TestServer</target_class>
+          <sql>server_test_id</sql>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+        </field>
+        <field id="password" xsi:type="AttributeEncryptedString" _delta="define">
+          <sql>password</sql>
+        </field>
+      </fields>
+    </class>
+  </classes>
+</itop_design>
--- a/tests/php-unit-tests/unitary-tests/core/RestServicesSanitizeOutputTest.php
+++ b/tests/php-unit-tests/unitary-tests/core/RestServicesSanitizeOutputTest.php
@@ -0,0 +1,167 @@
+<?php
+declare(strict_types=1);
+
+namespace Combodo\iTop\Test\UnitTest\Core;
+
+use ArchivedObjectException;
+use AttributeEncryptedString;
+use Combodo\iTop\Test\UnitTest\ItopCustomDatamodelTestCase;
+use CoreException;
+use CoreUnexpectedValue;
+use Exception;
+use MetaModel;
+use ormLinkSet;
+use PasswordTest;
+use RestResultWithObjects;
+
+/**
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ * @backupGlobals disabled
+ */
+class RestServicesSanitizeOutputTest extends ItopCustomDatamodelTestCase
+{
+	private const SIMPLE_PASSWORD = '123456';
+
+	/**
+	 * @throws Exception
+	 */
+	protected function setUp(): void
+	{
+		parent::setUp();
+	}
+
+	/**
+	 * @return void
+	 * @throws CoreException
+	 */
+	public function testSanitizeAttributeOnRequestedObject()
+	{
+		$oContactTest = MetaModel::NewObject('ContactTest', [
+				'password' => self::SIMPLE_PASSWORD
+			]
+		);
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oContactTest, ['ContactTest' => ['password']]);
+		$oRestResultWithObject->SanitizeContent();
+		static::assertJsonStringEqualsJsonString(
+			'{"objects":{"ContactTest::-1":{"code":0,"message":"ok","class":"ContactTest","key":-1,"fields":{"password":"*****"}}},"code":0,"message":null}',
+			json_encode($oRestResultWithObject));
+	}
+
+	/**
+	 * @return void
+	 * @throws Exception
+	 */
+	public function testSanitizeAttributeExternalFieldOnLink()
+	{
+		$oContactTest = $this->createObject('ContactTest', [
+				'password' => self::SIMPLE_PASSWORD
+			]
+		);
+
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'test_server',
+		]);
+
+
+		// create lnkContactTestToServer
+		$oLnkContactTestToServer = $this->createObject('lnkContactTestToServer', [
+			'contact_test_id' => $oContactTest->GetKey(),
+			'test_server_id'  => $oTestServer->GetKey()
+		]);
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oLnkContactTestToServer,
+			['lnkContactTestToServer' => ['contact_test_password']]);
+
+		$oRestResultWithObject->SanitizeContent();
+
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+	}
+
+	/**
+	 * @throws Exception
+	 */
+	public function testSanitizeAttributeOnObjectRelatedThroughNNRelation()
+	{
+		$oContactTest = $this->createObject('ContactTest', [
+			'password' => self::SIMPLE_PASSWORD
+		]);
+
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'test_server',
+		]);
+
+		// create lnkContactTestToServer
+		$this->createObject('lnkContactTestToServer', [
+			'contact_test_id' => $oContactTest->GetKey(),
+			'test_server_id'  => $oTestServer->GetKey()
+		]);
+
+		$oTestServer->Reload();
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oTestServer,
+			['TestServer' => ['contact_list']]);
+
+		$oRestResultWithObject->SanitizeContent();
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+	}
+
+
+	/**
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @throws ArchivedObjectException
+	 * @throws Exception
+	 */
+	public function testSanitizeOnObjectRelatedThrough1NRelation()
+	{
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'my_server',
+		]);
+
+		$oPassword = new PasswordTest();
+		$oPassword->Set('password', self::SIMPLE_PASSWORD);
+		$oPassword->Set('server_test_id', $oTestServer->GetKey());
+
+		/** @var ormLinkSet $oContactList */
+		$oContactList = $oTestServer->Get('password_list');
+		$oContactList->AddItem($oPassword);
+		$oTestServer->Set('password_list', $oContactList);
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oTestServer, ['TestServer' => ['id', 'password_list']]);
+		$oRestResultWithObject->SanitizeContent();
+
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+
+	}
+
+	/**
+	 * @return string Abs path to the XML delta to use for the tests of that class
+	 */
+	public function GetDatamodelDeltaAbsPath(): string
+	{
+		return __DIR__.'/Delta/delta_test_sanitize_output.xml';
+	}
+}
--- a/tests/php-unit-tests/unitary-tests/core/RestServicesTest.php
+++ b/tests/php-unit-tests/unitary-tests/core/RestServicesTest.php
@@ -0,0 +1,125 @@
+<?php
+declare(strict_types=1);
+
+namespace Combodo\iTop\Test\UnitTest\Core;
+
+use Combodo\iTop\Test\UnitTest\ItopDataTestCase;
+use CoreException;
+use CoreServices;
+use CoreUnexpectedValue;
+use RestResultWithObjects;
+use UserLocal;
+
+/**
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ * @backupGlobals disabled
+ */
+class RestServicesTest extends ItopDataTestCase
+{
+	/**
+	 * @return void
+	 * @dataProvider providerTestSanitizeJsonInput
+	 */
+	public function testSanitizeJsonInput($sJsonData, $sExpectedJsonDataSanitized)
+	{
+		$oRS = new CoreServices();
+		$sOutputJson = $oRS->SanitizeJsonInput($sJsonData);
+		static::assertJsonStringEqualsJsonString($sExpectedJsonDataSanitized, $sOutputJson);
+	}
+
+    /**
+     * @return array[]
+     */
+    public function providerTestSanitizeJsonInput(): array
+    {
+        return [
+                'core/check_credentials' => [
+                        '{"operation": "core/check_credentials", "user": "admin", "password": "admin"}',
+                        '{
+    "operation": "core/check_credentials",
+    "user": "admin",
+    "password": "*****"
+}'
+                ],
+                'core/update' => [
+                        '{"operation": "core/update", "comment": "Update user", "class": "UserLocal", "key": {"id":1}, "output_fields": "first_name, password", "fields": {"password" : "123456"}}',
+                        '{
+    "operation": "core/update",
+    "comment": "Update user",
+    "class": "UserLocal",
+    "key": {
+        "id": 1
+    },
+    "output_fields": "first_name, password",
+    "fields": {
+        "password": "*****"
+    }
+}'
+                ],
+                'core/create' => [
+                        '{"operation": "core/create", "comment": "Create user", "class": "UserLocal", "fields": {"first_name": "John", "last_name": "Doe", "email": "jd@example/com", "password" : "123456"}}',
+                        '{
+    "operation": "core/create",
+    "comment": "Create user",
+    "class": "UserLocal",
+    "fields": {
+        "first_name": "John",
+        "last_name": "Doe",
+        "email": "jd@example/com",
+        "password": "*****"
+    }
+}'
+                ],
+        ];
+    }
+
+	/**
+	 * @param $sOperation
+	 * @param $aJsonData
+	 * @param $sExpectedJsonDataSanitized
+	 * @return void
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @dataProvider providerTestSanitizeJsonOutput
+	 */
+	public function testSanitizeJsonOutput($sOperation, $aJsonData, $sExpectedJsonDataSanitized)
+	{
+		$oUser = new UserLocal();
+		$oUser->Set('password', '123456');
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oUser, ['UserLocal' => ['login', 'password']]);
+		$oRestResultWithObject->SanitizeContent();
+		static::assertJsonStringEqualsJsonString($sExpectedJsonDataSanitized, json_encode($oRestResultWithObject));
+	}
+
+    /**
+     * @return array[]
+     */
+    public function providerTestSanitizeJsonOutput(): array
+    {
+        return [
+
+                'core/update' => [
+                        'core/update',
+                        ['comment' => 'Update user', 'class' => 'UserLocal', 'key' => ['login' => 'my_example'], 'output_fields' => 'password', 'fields' => ['password' => 'opkB!req57']],
+                        '{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+                ],
+                'core/create' => [
+                        'core/create',
+                        ['comment' => 'Create user', 'class' => 'UserLocal', 'fields' => ['password' => 'Azertyuiiop*12', 'login' => 'toto', 'profile_list' => [1]]],
+                        '{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+                ],
+                'core/get' => [
+                        'core/get',
+                        ['comment' => 'Get user', 'class' => 'UserLocal', 'key' => ['login' => 'my_example'], 'output_fields' => 'first_name, password'],
+                        '{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+                ],
+                'core/check_credentials' => [
+                        'core/check_credentials',
+                        ['user' => 'admin', 'password' => 'admin'],
+                        '{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+                ],
+        ];
+    }
+}
--- a/webservices/rest.php
+++ b/webservices/rest.php
@@ -227,7 +227,11 @@ try
 		/** @var iRestServiceProvider $oRS */
 		$oRS = $aOpToRestService[$sOperation]['service_provider'];
 		$sProvider = get_class($oRS);
-	
+		
+		if ($oRS instanceof iRestInputSanitizer) {
+			$sSanitizedJsonInput = $oRS->SanitizeJsonInput($sJsonString);
+		}
+
 		CMDBObject::SetTrackOrigin('webservice-rest');
 		$oResult = $oRS->ExecOperation($sVersion, $sOperation, $aJsonData);
 	}
@@ -252,6 +256,7 @@ catch(Exception $e)
 //
 $sResponse = json_encode($oResult);

+
 if ($sResponse === false)
 {
 	$oJsonIssue = new RestResult();
@@ -283,7 +288,7 @@ if (MetaModel::GetConfig()->Get('log_rest_service'))
 	$oLog->SetTrim('userinfo', UserRights::GetUser());
 	$oLog->Set('version', $sVersion);
 	$oLog->Set('operation', $sOperation);
-	$oLog->SetTrim('json_input', $sJsonString);
+    $oLog->SetTrim('json_input', $sSanitizedJsonInput ?? $sJsonString);

 	$oLog->Set('provider', $sProvider);
 	$sMessage = $oResult->message;
@@ -293,7 +298,8 @@ if (MetaModel::GetConfig()->Get('log_rest_service'))
 	}
 	$oLog->SetTrim('message', $sMessage);
 	$oLog->Set('code', $oResult->code);
-	$oLog->SetTrim('json_output', $sResponse);
+	$oResult->SanitizeContent();
+	$oLog->SetTrim('json_output', json_encode($oResult, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));

 	$oLog->DBInsertNoReload();
 }
Author	SHA1	Message	Date
Benjamin Dalsass	f44468b7a1	N°8245 - External key not saved in n-n link in edition (#703 ) * N°8245 - External key not saved in n-n link in edition * Remove the listener from the input element itself, put it on the body with a selector that matches our input * Revert "N°8245 - External key not saved in n-n link in edition" This reverts commit `a756f9b159`. --------- Co-authored-by: Stephen Abello <stephen.abello@combodo.com>	2025-03-24 14:05:30 +01:00
jf-cbd	7af1cdebfa	Workaround for N°4459 doesn't work on 3.2	2025-03-24 11:21:41 +01:00
jf-cbd	a9fb5cd182	N°7870 - Tests: access the symfony service container to instantiate services	2025-03-24 11:02:34 +01:00
jf-cbd	9010504902	Fix tests	2025-03-24 10:53:18 +01:00
jf-cbd	2625b1ab54	Update tests for 3.1	2025-03-24 10:52:47 +01:00
Molkobain	b967338c48	🐛 N°8278 - Avoid autoloaders class name conflict by ensuring all existing have a unique name (#704 ) * 🐛 Avoid autoloaders class name conflict by ensuring all existing have a unique name * 🐛 Redump itop-attachments autoloaders for correct suffix	2025-03-24 10:15:09 +01:00
jf-cbd	10fbea5f4d	Fix merge conflict	2025-03-24 10:09:33 +01:00
jf-cbd	e49b8fc480	Merge remote-tracking branch 'origin/support/2.7' into support/3.2.1 # Conflicts: # core/restservices.class.inc.php # datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php # lib/composer/autoload_classmap.php # lib/composer/autoload_static.php	2025-03-24 10:07:36 +01:00
jf-cbd	4a415fdb59	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-03-21 14:44:18 +01:00
jf-cbd	5232694c04	N°8281 - Unable to click search button in multiple request template	2025-03-21 11:20:37 +01:00
Eric Espie	2a87d0aa15	N°8242 - When editing a dashboard the parameters do not refresh as expected	2025-03-18 17:40:10 +01:00
Anne-Cath	a103c458cb	N°8272 - Portal : Unable to save a date in French format - rollback removed code for N°7145	2025-03-18 16:58:50 +01:00
jf-cbd	874a5fd2ce	Dump autoloader	2025-03-12 11:36:06 +01:00
jf-cbd	063bb9680e	N°8231 - Better variable fallback	2025-03-06 16:09:51 +01:00
jf-cbd	8f8ac46f55	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-03-06 11:59:08 +01:00
denis.flaven@combodo.com	07b904ee1b	N°8231 - making rest api logs more readable	2025-03-06 11:59:08 +01:00