Since GLPI 10.0.18, forms won't validate

[Loiseau2nuit]

Describe the bug

Since upgrade to GLPI 10.0.18 (formcreator 2.13.10), it's impossible to validate some of our forms after we fill them in.
It seems to affect only forms with restricted access (profile:something or group:something-else)
Additionally (not sure if it's linked tho') but on those forms, the Glpi logo also won't display on top left, being blocked by 403 error (and by the way, called with an irrelevant URL / see screen capture)

To Reproduce

Steps to reproduce the behavior:

1. Go to a 'Forms' known to be broken
2. Fill it in
3. Click on "validate", or "send" or ... whatever you labeled your final button
   => it just won't validate and nothing specific happens

Expected behavior

Screenshots

GLPI / Plugins (please complete the following information):

GLPI 10.0.18-git-9389461d8a-9389461d8a ( => /var/www/glpi)
Installation mode: GIT
Current language:fr_FR

Server
Operating system: Linux uvappp05 6.1.0-37-amd64 # 1 SMP PREEMPT_DYNAMIC Debian 6.1.140-1 (2025-05-22) x86_64
PHP 8.2.28 fpm-fcgi (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apcu, bz2, calendar, cgi-fcgi, ctype, curl,
  date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imagick, imap, intl, json, ldap, libxml, mbstring, mysqli,
  mysqlnd, openssl, pcre, pdo_mysql, posix, random, readline, session, shmop, snmp, soap, sockets, sodium, standard, sysvmsg,
  sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib)
Setup: max_execution_time="30" memory_limit="128M" post_max_size="22M" safe_mode="" session.save_handler="files"
  upload_max_filesize="20M" disable_functions="" 
Software: nginx/1.22.1
  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Server Software: Debian 12
  Server Version: 10.11.11-MariaDB-0+deb12u1
  Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
  Parameters: GLPIdbAdmin@localhost/glpi
  Host info: Localhost via UNIX socket
  
PHP version (8.2.28) is supported.
Sessions configuration is OK.
Allocated memory is sufficient.
mysqli extension is installed.
Following extensions are installed: dom, fileinfo, filter, libxml, json, simplexml, xmlreader, xmlwriter.
curl extension is installed.
gd extension is installed.
intl extension is installed.
zlib extension is installed.
The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present.
Database engine version (10.11.11) is supported.
No files from previous GLPI version detected.
The log file has been created successfully.
Write access to /var/lib/glpi/_cache has been validated.
Write access to /var/lib/glpi/_cron has been validated.
Write access to /var/lib/glpi has been validated.
Write access to /var/lib/glpi/_dumps has been validated.
Write access to /var/lib/glpi/_graphs has been validated.
Write access to /var/lib/glpi/_lock has been validated.
Write access to /var/lib/glpi/_pictures has been validated.
Write access to /var/lib/glpi/_plugins has been validated.
Write access to /var/lib/glpi/_rss has been validated.
Write access to /var/lib/glpi/_sessions has been validated.
Write access to /var/lib/glpi/_tmp has been validated.
Write access to /var/lib/glpi/_uploads has been validated.

Web server root directory configuration seems safe.
Sessions configuration is secured.
OS and PHP are relying on 64 bits integers.
exif extension is installed.
ldap extension is installed.
openssl extension is installed.
Following extensions are installed: bz2, Phar, zip.
Zend OPcache extension is installed.
Following extensions are installed: ctype, iconv, mbstring, sodium.
Write access to /var/www/glpi/marketplace has been validated.
Timezones seems loaded in database.

GLPI constants
GLPI_ROOT: "/var/www/glpi"
GLPI_CONFIG_DIR: "/etc/glpi/"
GLPI_VAR_DIR: "/var/lib/glpi"
GLPI_LOG_DIR: "/var/log/glpi"
GLPI_MARKETPLACE_DIR: "/var/www/glpi/marketplace"
GLPI_USE_CSRF_CHECK: "1"
GLPI_CSRF_EXPIRES: "7200"
GLPI_CSRF_MAX_TOKENS: "100"
GLPI_USE_IDOR_CHECK: "1"
GLPI_IDOR_EXPIRES: "7200"
GLPI_ALLOW_IFRAME_IN_RICH_TEXT: false
GLPI_SERVERSIDE_URL_ALLOWLIST: ["#^http://[^@:]+(:80)?(/.*)?$#","#^https://[^@:]+(:443)?(/.*)?$#","#^feed://[^@:]+(/.*)?$#"]
GLPI_DISALLOWED_UPLOADS_PATTERN: "/\\.(php\\d*|phar)$/i"
GLPI_TELEMETRY_URI: "https://telemetry.glpi-project.org"
GLPI_INSTALL_MODE: "GIT"
GLPI_NETWORK_MAIL: "glpi@teclib.com"
GLPI_NETWORK_SERVICES: "https://services.glpi-network.com"
GLPI_MARKETPLACE_ALLOW_OVERRIDE: true
GLPI_MARKETPLACE_MANUAL_DOWNLOADS: true
GLPI_USER_AGENT_EXTRA_COMMENTS: ""
GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: "1"
GLPI_AJAX_DASHBOARD: "1"
GLPI_CALDAV_IMPORT_STATE: 0
GLPI_DEMO_MODE: "0"
GLPI_CENTRAL_WARNINGS: "1"
GLPI_TEXT_MAXSIZE: "4000"
GLPI_DOC_DIR: "/var/lib/glpi"
GLPI_CACHE_DIR: "/var/lib/glpi/_cache"
GLPI_CRON_DIR: "/var/lib/glpi/_cron"
GLPI_DUMP_DIR: "/var/lib/glpi/_dumps"
GLPI_GRAPH_DIR: "/var/lib/glpi/_graphs"
GLPI_LOCAL_I18N_DIR: "/var/lib/glpi/_locales"
GLPI_LOCK_DIR: "/var/lib/glpi/_lock"
GLPI_PICTURE_DIR: "/var/lib/glpi/_pictures"
GLPI_PLUGIN_DOC_DIR: "/var/lib/glpi/_plugins"
GLPI_RSS_DIR: "/var/lib/glpi/_rss"
GLPI_SESSION_DIR: "/var/lib/glpi/_sessions"
GLPI_TMP_DIR: "/var/lib/glpi/_tmp"
GLPI_UPLOAD_DIR: "/var/lib/glpi/_uploads"
GLPI_INVENTORY_DIR: "/var/lib/glpi/_inventories"
GLPI_NETWORK_REGISTRATION_API_URL: "https://services.glpi-network.com/api/registration/"
GLPI_MARKETPLACE_PLUGINS_API_URI: "https://services.glpi-network.com/api/marketplace/"
GLPI_I18N_DIR: "/var/www/glpi/locales"
GLPI_VERSION: "10.0.18"
GLPI_SCHEMA_VERSION: "10.0.18@d64066799f068b16ee973b377bdd13f984fe062a"
GLPI_MARKETPLACE_PRERELEASES: false
GLPI_MIN_PHP: "7.4.0"
GLPI_MAX_PHP: "8.4.0"
GLPI_YEAR: "2025"

Libraries
htmlawed/htmlawed version 1.2.14 in (/var/www/glpi/vendor/htmlawed/htmlawed)
phpmailer/phpmailer version 6.8.0 in (/var/www/glpi/vendor/phpmailer/phpmailer/src)
simplepie/simplepie version 1.5.8 in (/var/www/glpi/vendor/simplepie/simplepie/library)
tecnickcom/tcpdf version 6.8.0 in (/var/www/glpi/vendor/tecnickcom/tcpdf)
michelf/php-markdown in (/var/www/glpi/vendor/michelf/php-markdown/Michelf)
true/punycode in (/var/www/glpi/vendor/true/punycode/src)
iamcal/lib_autolink in (/var/www/glpi/vendor/iamcal/lib_autolink)
sabre/dav in (/var/www/glpi/vendor/sabre/dav/lib/DAV)
sabre/http in (/var/www/glpi/vendor/sabre/http/lib)
sabre/uri in (/var/www/glpi/vendor/sabre/uri/lib)
sabre/vobject in (/var/www/glpi/vendor/sabre/vobject/lib)
laminas/laminas-i18n in (/var/www/glpi/vendor/laminas/laminas-i18n/src)
laminas/laminas-servicemanager in (/var/www/glpi/vendor/laminas/laminas-servicemanager/src)
monolog/monolog in (/var/www/glpi/vendor/monolog/monolog/src/Monolog)
sebastian/diff in (/var/www/glpi/vendor/sebastian/diff/src)
donatj/phpuseragentparser in (/var/www/glpi/vendor/donatj/phpuseragentparser/src/UserAgent)
elvanto/litemoji in (/var/www/glpi/vendor/elvanto/litemoji/src)
symfony/console in (/var/www/glpi/vendor/symfony/console)
scssphp/scssphp in (/var/www/glpi/vendor/scssphp/scssphp/src)
laminas/laminas-mail in (/var/www/glpi/vendor/laminas/laminas-mail/src/Protocol)
laminas/laminas-mime in (/var/www/glpi/vendor/laminas/laminas-mime/src)
rlanvin/php-rrule in (/var/www/glpi/vendor/rlanvin/php-rrule/src)
ramsey/uuid in (/var/www/glpi/vendor/ramsey/uuid/src)
psr/log in (/var/www/glpi/vendor/psr/log/Psr/Log)
psr/simple-cache in (/var/www/glpi/vendor/psr/simple-cache/src)
psr/cache in (/var/www/glpi/vendor/psr/cache/src)
league/csv in (/var/www/glpi/vendor/league/csv/src)
mexitek/phpcolors in (/var/www/glpi/vendor/mexitek/phpcolors/src/Mexitek/PHPColors)
guzzlehttp/guzzle in (/var/www/glpi/vendor/guzzlehttp/guzzle/src)
guzzlehttp/psr7 in (/var/www/glpi/vendor/guzzlehttp/psr7/src)
glpi-project/inventory_format in (/var/www/glpi/vendor/glpi-project/inventory_format/lib/php)
wapmorgan/unified-archive in (/var/www/glpi/vendor/wapmorgan/unified-archive/src)
paragonie/sodium_compat in (/var/www/glpi/vendor/paragonie/sodium_compat/src)
symfony/cache in (/var/www/glpi/vendor/symfony/cache)
html2text/html2text in (/var/www/glpi/vendor/html2text/html2text/src)
symfony/css-selector in (/var/www/glpi/vendor/symfony/css-selector)
symfony/dom-crawler in (/var/www/glpi/vendor/symfony/dom-crawler)
twig/twig in (/var/www/glpi/vendor/twig/twig/src)
twig/string-extra in (/var/www/glpi/vendor/twig/string-extra)
symfony/polyfill-ctype not found
symfony/polyfill-iconv not found
symfony/polyfill-mbstring not found
symfony/polyfill-php80 not found
symfony/polyfill-php81 not found
symfony/polyfill-php82 in (/var/www/glpi/vendor/symfony/polyfill-php82)
league/oauth2-client in (/var/www/glpi/vendor/league/oauth2-client/src/Provider)
league/oauth2-google in (/var/www/glpi/vendor/league/oauth2-google/src/Provider)
thenetworg/oauth2-azure in (/var/www/glpi/vendor/thenetworg/oauth2-azure/src/Provider)

LDAP directories
Server: 'srv-ad01.**********.fr', Port: '389', BaseDN: 'ou=Mairie,dc=**********,dc=fr', Connection filter:
    '(&(objectClass=user)(!(samAccountName=test*))(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))',
    RootDN: 'glpi@**********.fr', Use TLS: none

SQL replicas
Not active

Notifications
Way of sending emails: SMTP+TLS (glpi@************.fr@messagerie.************.fr)

Plugins list
  archibp              Name: Business Processes             Version: 2.0.12     State: Installed / not activated               
    Install Method: Marketplace
  camerainput          Name: Camera Input                   Version: 2.1.0      State: Installed / not activated               
    Install Method: Marketplace
  fields               Name: Champs supplémentaires         Version: 1.21.21    State: Enabled                                 
    Install Method: Marketplace
  behaviors            Name: Comportements                  Version: 2.7.5      State: Enabled                                 
    Install Method: Marketplace
  mydashboard          Name: Dashboard                      Version: 2.1.5      State: Installed / not activated               
    Install Method: Marketplace
  datainjection        Name: Data Injection                 Version: 2.14.1     State: Enabled                                 
    Install Method: Marketplace
  escalade             Name: Escalades                      Version: 2.9.13     State: Installed / not activated               
    Install Method: Marketplace
  dataflows            Name: Flux de données                Version: 3.0.13     State: Installed / not activated               
    Install Method: Marketplace
  formcreator          Name: Form Creator                   Version: 2.13.10    State: Enabled                                 
    Install Method: Marketplace
  gantt                Name: gantt                          Version: 1.1.0      State: Installed / not activated               
    Install Method: Marketplace
  gappessentials       Name: Gapp Essentials                Version: 2.3.0      State: Enabled                                 
    Install Method: Marketplace
  genericobject        Name: Gestion d'objets               Version: 2.14.14    State: Enabled                                 
    Install Method: Marketplace
  glpiinventory        Name: GLPI Inventory                 Version: 1.5.3      State: Enabled                                 
    Install Method: Marketplace
  manufacturersimports Name: Imports fabricants             Version: 3.0.9      State: Enabled                                 
    Install Method: Marketplace
  moreticket           Name: More ticket                    Version: 1.7.5      State: Enabled                                 
    Install Method: Marketplace
  mreporting           Name: Plus de rapports               Version: 1.8.7      State: Enabled                                 
    Install Method: Marketplace
  statecheck           Name: Régles de vérification d'état  Version: 2.4.4      State: Installed / not activated              
     Install Method: Marketplace
  archisw              Name: Structures d'Applications      Version: 3.0.20     State: Installed / not activated               
    Install Method: Marketplace
  webresources         Name: Web Resources                  Version: 2.0.4      State: Enabled                                 
    Install Method: Marketplace

Desktop (please complete the following information):

• OS: [e.g. iOS] : all
• Browser [e.g. chrome, safari] : all
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[Loiseau2nuit]

This is still on after upgrade to GLPI 10.0.19 (same version formcreator 2.13.10)

[mchuche]

Hello,

We have the same problem; there's an incompatibility between the Formcreator and Behaviors plugins.

When the 'Use the technician's group' option of the 'Behavior' plugin is configured to 'First' or 'All,' we cannot validate certain forms (No response when clicking the Send button) .

It seems the problem occurs when the "Assigned to" field is empty (defined on target ticket into formcreator survey or rules)

In the meantime, we've configured the 'Use the technician's group' option of the 'Behavior' plugin to 'No' while we find a solution.

Regarding the second problem, we haven't noticed anything, perhaps because we have a custom logo.

'Behavior' plugin: 2.7.5 to 2.7.8
'Formcreator' plugin: 2.13.10
GLPI 10.0.19

[btry]

Hi

What about php-errors.log and sql-errors.log ? Is there someting useful here ?

Also, it it worth to know that when a form is submitted, the server sends a JSON response which contains instructions to redirect the user to the newt web page. Usually, when the send button fails, this is because something polluted the JSON message. Checking browser side could also be relevant.

[mchuche]

Some more information.

php-errors.log :

[2025-08-20 14:20:54] glpiphplog.CRITICAL:   *** Uncaught Exception RuntimeException: Empty IN are not allowed in /var/www/glpi/src/DBmysqlIterator.php at line 589
  Backtrace :
  src/DBmysqlIterator.php:560                        DBmysqlIterator->analyseCriterion()
  src/DBmysqlIterator.php:315                        DBmysqlIterator->analyseCrit()
  src/DBmysqlIterator.php:111                        DBmysqlIterator->buildQuery()
  src/DBmysql.php:1105                               DBmysqlIterator->execute()
  marketplace/behaviors/inc/user.class.php:56        DBmysql->request()
  marketplace/behaviors/inc/user.class.php:72        PluginBehaviorsUser::getUserGroup()
  marketplace/behaviors/inc/ticket.class.php:639     PluginBehaviorsUser::getTechnicianGroup()
  src/Plugin.php:1713                                PluginBehaviorsTicket::afterPrepareAdd()
  src/CommonDBTM.php:1308                            Plugin::doHook()
  ...lace/formcreator/inc/targetticket.class.php:914 CommonDBTM->add()
  ...place/formcreator/inc/formanswer.class.php:1004 PluginFormcreatorTargetTicket->save()
  ...place/formcreator/inc/formanswer.class.php:1238 PluginFormcreatorFormAnswer->generateTarget()
  src/CommonDBTM.php:1346                            PluginFormcreatorFormAnswer->post_addItem()
  marketplace/formcreator/ajax/formanswer.php:60     CommonDBTM->add()
  public/index.php:82                                require()

sql-errors.log
Nothing useful here.

Dev browser
notification_ajax.php don't stop

[btry]

It is normal to get repeated requests to notification_ajax.php.

The bug seems be located in the Behaviors plugin.

As the code to patch in that plugin is not very clear and I never had to work with it, I recommend to open an issue here: https://github.com/InfotelGLPI/behaviors/issues

I think the code to fix is here https://github.com/InfotelGLPI/behaviors/blob/master/inc/ticket.class.php#L833

Before that line the variable $ticket->input['_users_id_assign'] should be checked, and if it is not a valid user ID or an empty array (I think it may be an array) then the method should exist without doing anything. This is also an opportunity to cleanup the complexity of the If statement in line 833.

[teagos2]

Estavamos passando pelo mesmo problema na versão
Plugin 'Comportamento': 2.7.5 a 2.7.8
Plugin 'Criador de formulários': 2.13.10
GLPI 10.0.19

com apoio da solução daqui verificamos que o campo recomendado a ser desativado "Enquanto isso, configuramos a opção 'Usar o grupo de técnicos' do plugin 'Comportamento' como 'Não' enquanto encontramos uma solução." já estava como não, fazendo com que a solução não fosse efetiva para nós, porem só de saber o plugin que estava dando divergência seguimos testando todos os campos e verificamos que todos os campos dentro de "comportamento> grupo novo chamado" devem estar como "não" e ele voltou a funcionar.