From c0ce584487af128fde4e862dc8357f4d5e26ef8b Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 00:26:04 +0200
Subject: [PATCH 1/6] Look and feel v12

---
 htdocs/core/lib/company.lib.php   |  5 ++++-
 htdocs/core/lib/functions.lib.php |  4 ++--
 htdocs/societe/consumption.php    | 15 +++++++++------
 htdocs/societe/paymentmodes.php   |  2 +-
 4 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php
index 4b0a2d5b131..ec8e91f5419 100644
--- a/htdocs/core/lib/company.lib.php
+++ b/htdocs/core/lib/company.lib.php
@@ -802,7 +802,10 @@ function show_projects($conf, $langs, $db, $object, $backtopage = '', $nocreatel
                         print '<tr class="oddeven">';
 
                         // Ref
-                        print '<td><a href="'.DOL_URL_ROOT.'/projet/card.php?id='.$projecttmp->id.'">'.img_object($langs->trans("ShowProject"), ($obj->public ? 'projectpub' : 'project'))." ".$obj->ref.'</a></td>';
+                        print '<td>';
+                        print $projecttmp->getNomUrl(1);
+                        print '</td>';
+
                         // Label
                         print '<td>'.$obj->title.'</td>';
                         // Date start
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index d08522bfaa4..2d8996523fe 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -3167,7 +3167,7 @@ function img_picto($titlealt, $picto, $moreatt = '', $pictoisfullpath = false, $
         		'object_phoning', 'object_phoning_mobile', 'object_phoning_fax', 'object_email', 'object_website',
         		'off', 'on', 'order',
         		'paiment', 'play', 'playdisabled', 'poll', 'printer', 'product', 'propal', 'projecttask', 'stock', 'resize', 'service', 'stats', 'trip',
-				'setup', 'sign-out', 'split', 'switch_off', 'switch_on', 'tools', 'unlink', 'uparrow', 'user', 'vcard', 'wrench',
+				'setup', 'sign-out', 'split', 'stripe-s', 'switch_off', 'switch_on', 'tools', 'unlink', 'uparrow', 'user', 'vcard', 'wrench',
 				'jabber', 'skype', 'twitter', 'facebook', 'linkedin', 'instagram', 'snapchat', 'youtube', 'google-plus-g', 'whatsapp',
 				'chevron-left', 'chevron-right', 'chevron-down', 'chevron-top',
 				'home', 'companies', 'products', 'commercial', 'invoicing', 'preview', 'project', 'projectpub', 'supplier_invoice', 'hrm', 'members', 'ticket', 'generic',
@@ -3181,7 +3181,7 @@ function img_picto($titlealt, $picto, $moreatt = '', $pictoisfullpath = false, $
 			if (in_array($pictowithouttext, array('object_generic', 'note', 'off', 'on', 'object_bookmark', 'bookmark', 'vcard'))) {
 				$fa = 'far';
 			}
-			if (in_array($pictowithouttext, array('skype', 'twitter', 'facebook', 'linkedin', 'instagram', 'snapchat', 'youtube', 'google-plus-g', 'whatsapp'))) {
+			if (in_array($pictowithouttext, array('skype', 'twitter', 'facebook', 'linkedin', 'instagram', 'snapchat', 'stripe-s', 'youtube', 'google-plus-g', 'whatsapp'))) {
 				$fa = 'fab';
 			}
 
diff --git a/htdocs/societe/consumption.php b/htdocs/societe/consumption.php
index ad7383d81af..0ce28356d90 100644
--- a/htdocs/societe/consumption.php
+++ b/htdocs/societe/consumption.php
@@ -31,6 +31,8 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.class.php';
 
+$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'thirdpartylist';
+
 // Security check
 $socid = GETPOST('socid', 'int');
 if ($user->socid) $socid = $user->socid;
@@ -147,6 +149,7 @@ if ($conf->ficheinter->enabled && $user->rights->ficheinter->lire) $elementTypeA
 
 if ($object->fournisseur)
 {
+	$langs->load("supplier_proposal");
 	print '<tr><td class="titlefield">';
 	print $langs->trans('SupplierCode').'</td><td colspan="3">';
 	print $object->code_fournisseur;
@@ -352,14 +355,14 @@ if ($sql_select)
 
 	$num = $db->num_rows($resql);
 
-	$param = "&socid=".$socid."&type_element=".$type_element;
-    if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.$contextpage;
-	if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.$limit;
+	$param = "&socid=".urlencode($socid)."&type_element=".urlencode($type_element);
+    if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.urlencode($contextpage);
+	if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit);
 	if ($sprod_fulldescr) $param .= "&sprod_fulldescr=".urlencode($sprod_fulldescr);
 	if ($sref) $param .= "&sref=".urlencode($sref);
-	if ($month) $param .= "&month=".$month;
-	if ($year) $param .= "&year=".$year;
-	if ($optioncss != '') $param .= '&optioncss='.$optioncss;
+	if ($month) $param .= "&month=".urlencode($month);
+	if ($year) $param .= "&year=".urlencode($year);
+	if ($optioncss != '') $param .= '&optioncss='.urlencode($optioncss);
 
     print_barre_liste($langs->trans('ProductsIntoElements').' '.$typeElementString.' '.$button, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, '', $num, $totalnboflines, '', 0, '', '', $limit);
 
diff --git a/htdocs/societe/paymentmodes.php b/htdocs/societe/paymentmodes.php
index 6385346ce5d..e0636932cc2 100644
--- a/htdocs/societe/paymentmodes.php
+++ b/htdocs/societe/paymentmodes.php
@@ -963,7 +963,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 		{
             $morehtmlright .= dolGetButtonTitle($langs->trans('Add'), '', 'fa fa-plus-circle', $_SERVER["PHP_SELF"].'?socid='.$object->id.'&amp;action=createcard');
 		}
-		print load_fiche_titre($langs->trans('StripePaymentModes').($stripeacc ? ' (Stripe connection with StripeConnect account '.$stripeacc.')' : ' (Stripe connection with keys from Stripe module setup)'), $morehtmlright, '');
+		print load_fiche_titre($langs->trans('StripePaymentModes').($stripeacc ? ' (Stripe connection with StripeConnect account '.$stripeacc.')' : ' (Stripe connection with keys from Stripe module setup)'), $morehtmlright, 'stripe-s');
 
 		$listofsources = array();
 		if (is_object($stripe))

From d3e21c82f2cd3cbf6f2e51d54a2b97321cc869e1 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 02:38:12 +0200
Subject: [PATCH 2/6] CSS

---
 htdocs/theme/eldy/global.inc.php | 3 +++
 htdocs/theme/md/style.css.php    | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php
index 4eaa193e682..3f6d999104e 100644
--- a/htdocs/theme/eldy/global.inc.php
+++ b/htdocs/theme/eldy/global.inc.php
@@ -1963,6 +1963,9 @@ div.mainmenu {
 	margin-left: 0px;
 	min-width: 40px;
 }
+a.tmenuimage:focus, .mainmenu.topmenuimage:focus {
+    outline: none;
+}
 
 /* For mainmenu, we always load the img */
 
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index f1e2c9257e6..b9fe51ca252 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -2005,6 +2005,9 @@ div.mainmenu {
 	margin-left: 0px;
 	min-width: 40px;
 }
+a.tmenuimage:focus, .mainmenu.topmenuimage:focus {
+    outline: none;
+}
 
 /* Do not load menu img if hidden to save bandwidth */
 <?php if (empty($dol_hide_topmenu)) { ?>

From 3f4ae8875fdae9895cbcdb73fbdc574518275a62 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 02:45:09 +0200
Subject: [PATCH 3/6] Fix bad tooltip

---
 htdocs/asset/class/asset.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/asset/class/asset.class.php b/htdocs/asset/class/asset.class.php
index 7c9d91d79e7..21cd3b6393e 100644
--- a/htdocs/asset/class/asset.class.php
+++ b/htdocs/asset/class/asset.class.php
@@ -82,7 +82,7 @@ class Asset extends CommonObject
 		'label' => array('type'=>'varchar(255)', 'label'=>'Label', 'visible'=>1, 'enabled'=>1, 'position'=>30, 'notnull'=>-1, 'searchall'=>1),
 		'amount_ht' => array('type'=>'double(24,8)', 'label'=>'AmountHTShort', 'visible'=>1, 'enabled'=>1, 'position'=>40, 'notnull'=>-1, 'isameasure'=>'1', 'help'=>"Help text",),
 		'amount_vat' => array('type'=>'double(24,8)', 'label'=>'AmountVAT', 'visible'=>1, 'enabled'=>1, 'position'=>40, 'notnull'=>-1, 'isameasure'=>'1', 'help'=>"Help text",),
-		'fk_asset_type' => array('type'=>'integer:AssetType:asset/class/asset_type.class.php', 'label'=>'AssetsType', 'visible'=>1, 'enabled'=>1, 'position'=>50, 'notnull'=>1, 'index'=>1, 'searchall'=>1, 'help'=>"LinkToThirparty",),
+		'fk_asset_type' => array('type'=>'integer:AssetType:asset/class/asset_type.class.php', 'label'=>'AssetsType', 'visible'=>1, 'enabled'=>1, 'position'=>50, 'notnull'=>1, 'index'=>1, 'searchall'=>1),
 		'description' => array('type'=>'text', 'label'=>'Description', 'visible'=>-1, 'enabled'=>1, 'position'=>90, 'notnull'=>-1,),
 		'note_public' => array('type'=>'html', 'label'=>'NotePublic', 'visible'=>-1, 'enabled'=>1, 'position'=>91, 'notnull'=>-1,),
 		'note_private' => array('type'=>'html', 'label'=>'NotePrivate', 'visible'=>-1, 'enabled'=>1, 'position'=>92, 'notnull'=>-1,),

From 479e8ceceb300ce212f963fdf4bf0ab8320a92fc Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 03:19:37 +0200
Subject: [PATCH 4/6] Look and feel v12

---
 htdocs/opensurvey/card.php      | 2 +-
 htdocs/opensurvey/css/style.css | 2 +-
 htdocs/opensurvey/results.php   | 7 +++++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/htdocs/opensurvey/card.php b/htdocs/opensurvey/card.php
index 32dde7ddb3e..56aabc24721 100644
--- a/htdocs/opensurvey/card.php
+++ b/htdocs/opensurvey/card.php
@@ -214,7 +214,7 @@ print '<input type="hidden" name="action" value="update">';
 $head = opensurvey_prepare_head($object);
 
 
-dol_fiche_head($head, 'general', $langs->trans("Survey"), -1, DOL_URL_ROOT.'/opensurvey/img/object_opensurvey.png', 1);
+dol_fiche_head($head, 'general', $langs->trans("Survey"), -1, 'poll');
 
 $morehtmlref = '';
 
diff --git a/htdocs/opensurvey/css/style.css b/htdocs/opensurvey/css/style.css
index e6b84f5fde5..d9cf48c72ee 100644
--- a/htdocs/opensurvey/css/style.css
+++ b/htdocs/opensurvey/css/style.css
@@ -367,8 +367,8 @@ div.cadre td.vide {
 /*Case de tableau contenant les noms dans affichage de sondage*/
 div.cadre td.nom {
 	background-color: #DDDDDD;
-	font-size:12px;
 	text-align:center;
+	padding: 8px;
 }
 div.cadre td.casevide {
 	background-color: white;
diff --git a/htdocs/opensurvey/results.php b/htdocs/opensurvey/results.php
index 337ccb3e435..181ec830433 100644
--- a/htdocs/opensurvey/results.php
+++ b/htdocs/opensurvey/results.php
@@ -421,10 +421,11 @@ $toutsujet = str_replace("°", "'", $toutsujet);
 
 
 print '<form name="formulaire4" action="#" method="POST">'."\n";
+print '<input type="hidden" name="token" value="'.newToken().'">';
 
 $head = opensurvey_prepare_head($object);
 
-dol_fiche_head($head, 'preview', $langs->trans("Survey"), -1, DOL_URL_ROOT.'/opensurvey/img/object_opensurvey.png', 1);
+dol_fiche_head($head, 'preview', $langs->trans("Survey"), -1, 'poll');
 
 $morehtmlref = '';
 
@@ -519,6 +520,7 @@ if (GETPOST('ajoutsujet'))
 	if (!$user->rights->opensurvey->write) accessforbidden();
 
 	print '<form name="formulaire" action="" method="POST">'."\n";
+	print '<input type="hidden" name="token" value="'.newToken().'">';
 	print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage', 'alpha').'">';
 
 	print '<div class="center">'."\n";
@@ -605,6 +607,7 @@ if ($user->rights->opensurvey->write) {
 $nbcolonnes = substr_count($object->sujet, ',') + 1;
 
 print '<form name="formulaire" action="" method="POST">'."\n";
+print '<input type="hidden" name="token" value="'.newToken().'">';
 
 print '<div class="cadre"> '."\n";
 
@@ -766,7 +769,7 @@ else
 		print '<td class="sujet">'.dol_htmlentities($tmp[0]).'</td>'."\n";
 	}
 
-	print '<td class="sujet"><a href="'.$_SERVER["PHP_SELF"].'?id='.$numsondage.'&ajoutsujet=1&backtopage='.urlencode($_SERVER["PHP_SELF"]).'">'.img_picto('', dol_buildpath('/opensurvey/img/add-16.png', 1), '', 1).'</a></td>'."\n";
+	print '<td class="sujet"><a href="'.$_SERVER["PHP_SELF"].'?id='.$numsondage.'&ajoutsujet=1&backtopage='.urlencode($_SERVER["PHP_SELF"]).'"><span class="fa fa-plus-circle valignmiddle btnTitle-icon"></span></a></td>'."\n";
 	print '</tr>'."\n";
 }
 

From 0b48ffe3cd127e503c3493bc084d75af82bbbbb6 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 11:38:28 +0200
Subject: [PATCH 5/6] Removed not used var $useglobalvars

---
 htdocs/core/ajax/ajaxdirpreview.php   | 2 +-
 htdocs/core/class/html.form.class.php | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/htdocs/core/ajax/ajaxdirpreview.php b/htdocs/core/ajax/ajaxdirpreview.php
index bb6a8de30d4..83227b00e51 100644
--- a/htdocs/core/ajax/ajaxdirpreview.php
+++ b/htdocs/core/ajax/ajaxdirpreview.php
@@ -355,7 +355,7 @@ if ($useajax || $action == 'delete')
 	$section_id = $section;
 
 	require_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php';
-	$useglobalvars = 1;
+
 	$form = new Form($db);
 	$formquestion['urlfile'] = array('type'=>'hidden', 'value'=>$urlfile, 'name'=>'urlfile'); // We must always put field, even if empty because it is filled by javascript later
 	$formquestion['section'] = array('type'=>'hidden', 'value'=>$section, 'name'=>'section'); // We must always put field, even if empty because it is filled by javascript later
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index f2b11938ca2..30519077c9e 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -4207,7 +4207,6 @@ class Form
     public function formconfirm($page, $title, $question, $action, $formquestion = '', $selectedchoice = '', $useajax = 0, $height = 0, $width = 500, $disableformtag = 0)
 	{
 		global $langs, $conf;
-		global $useglobalvars;
 
 		$more = '<!-- formconfirm -->';
 		$formconfirm = '';
@@ -4355,7 +4354,7 @@ class Form
 					if (isset($input['inputko']) && $input['inputko'] == 1) array_push($inputko, $input['name']);
 				}
 			}
-			// Show JQuery confirm box. Note that global var $useglobalvars is used inside this template
+			// Show JQuery confirm box.
 			$formconfirm .= '<div id="'.$dialogconfirm.'" title="'.dol_escape_htmltag($title).'" style="display: none;">';
 			if (!empty($formquestion['text'])) {
 				$formconfirm .= '<div class="confirmtext">'.$formquestion['text'].'</div>'."\n";

From a207365bd2f3373405e04ebd292b29529d3b4217 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 27 May 2020 13:12:18 +0200
Subject: [PATCH 6/6] FIX XSS using the renaming of .noexe files - reported by
 Nolan.

---
 htdocs/core/class/html.formfile.class.php |  3 +-
 htdocs/core/lib/files.lib.php             | 27 +++++++++--------
 htdocs/core/tpl/filemanager.tpl.php       |  4 +--
 htdocs/ecm/class/ecmfiles.class.php       | 36 ++++++++++++-----------
 htdocs/ecm/file_card.php                  | 26 ++++++++++++----
 htdocs/ecm/index.php                      |  6 ++--
 htdocs/langs/en_US/errors.lang            |  1 +
 7 files changed, 63 insertions(+), 40 deletions(-)

diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index ec9dff5f1a3..97a4bdf1948 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -1269,7 +1269,8 @@ class FormFile
 					}
 					else
 					{
-						print dol_trunc($file['name'], 200);
+						$filenametoshow = preg_replace('/\.noexe$/', '', $file['name']);
+						print dol_trunc($filenametoshow, 200);
 						print '</a>';
 					}
 					// Preview link
diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index 41d7bf1b294..6614b22e5ed 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -870,7 +870,7 @@ function dol_move($srcfile, $destfile, $newmask = 0, $overwriteifexists = 1, $te
 			{
 				$rel_filetorenamebefore = preg_replace('/^[\\/]/', '', $rel_filetorenamebefore);
 				$rel_filetorenameafter = preg_replace('/^[\\/]/', '', $rel_filetorenameafter);
-				//var_dump($rel_filetorenamebefore.' - '.$rel_filetorenameafter);
+				//var_dump($rel_filetorenamebefore.' - '.$rel_filetorenameafter);exit;
 
 				dol_syslog("Try to rename also entries in database for full relative path before = ".$rel_filetorenamebefore." after = ".$rel_filetorenameafter, LOG_DEBUG);
 				include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
@@ -893,6 +893,7 @@ function dol_move($srcfile, $destfile, $newmask = 0, $overwriteifexists = 1, $te
 
 					$ecmfile->filepath = $rel_dir;
 					$ecmfile->filename = $filename;
+
 					$resultecm = $ecmfile->update($user);
 				}
 				elseif ($resultecm == 0)   // If no entry were found for src files, create/update target file
@@ -995,7 +996,7 @@ function dolCheckVirus($src_file)
  * 	@param	integer	$uploaderrorcode	Value of PHP upload error code ($_FILES['field']['error'])
  * 	@param	int		$nohook				Disable all hooks
  * 	@param	string	$varfiles			_FILES var name
- *	@return int|string       			>0 if OK, <0 or string if KO
+ *	@return int|string       			1 if OK, 2 if OK and .noexe appended, <0 or string if KO
  *  @see    dol_move()
  */
 function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disablevirusscan = 0, $uploaderrorcode = 0, $nohook = 0, $varfiles = 'addedfile')
@@ -1005,6 +1006,7 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
 
 	$reshook = 0;
 	$file_name = $dest_file;
+	$successcode = 1;
 
 	if (empty($nohook))
 	{
@@ -1055,6 +1057,7 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
 		if (isAFileWithExecutableContent($dest_file) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED))
 		{
 			$file_name .= '.noexe';
+			$successcode = 2;
 		}
 
 		// Security:
@@ -1109,7 +1112,7 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
 		{
 			if (!empty($conf->global->MAIN_UMASK)) @chmod($file_name_osencoded, octdec($conf->global->MAIN_UMASK));
 			dol_syslog("Files.lib::dol_move_uploaded_file Success to move ".$src_file." to ".$file_name." - Umask=".$conf->global->MAIN_UMASK, LOG_DEBUG);
-			return 1; // Success
+			return $successcode; // Success
 		}
 		else
 		{
@@ -1118,7 +1121,7 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
 		}
 	}
 
-	return 1; // Success
+	return $successcode; // Success
 }
 
 /**
@@ -1173,8 +1176,6 @@ function dol_delete_file($file, $disableglob = 0, $nophperrors = 0, $nohook = 0,
 	}
 	else
 	{
-		$error = 0;
-
 		//print "x".$file." ".$disableglob;exit;
 		$file_osencoded = dol_osencode($file); // New filename encoded in OS filesystem encoding charset
 		if (empty($disableglob) && !empty($file_osencoded))
@@ -1197,10 +1198,11 @@ function dol_delete_file($file, $disableglob = 0, $nophperrors = 0, $nohook = 0,
 						$rel_filetodelete = preg_replace('/^'.preg_quote(DOL_DATA_ROOT, '/').'/', '', $filename);
 						if (!preg_match('/(\/temp\/|\/thumbs\/|\.meta$)/', $rel_filetodelete))     // If not a tmp file
 						{
-							$rel_filetodelete = preg_replace('/^[\\/]/', '', $rel_filetodelete);
-
 							if (is_object($db) && $indexdatabase)		// $db may not be defined when lib is in a context with define('NOREQUIREDB',1)
 							{
+								$rel_filetodelete = preg_replace('/^[\\/]/', '', $rel_filetodelete);
+								$rel_filetodelete = preg_replace('/\.noexe$/', '', $rel_filetodelete);
+
 								dol_syslog("Try to remove also entries in database for full relative path = ".$rel_filetodelete, LOG_DEBUG);
 								include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
 								$ecmfile = new EcmFiles($db);
@@ -1564,6 +1566,7 @@ function dol_add_file_process($upload_dir, $allowoverwrite = 0, $donotupdatesess
 				$destfile = dol_string_nohtmltag($destfile);
 				$destfull = dol_string_nohtmltag($destfull);
 
+				// Move file from temp directory to final directory. A .noexe may also be appended on file name.
 				$resupload = dol_move_uploaded_file($TFile['tmp_name'][$i], $destfull, $allowoverwrite, 0, $TFile['error'][$i], 0, $varfiles);
 
 				if (is_numeric($resupload) && $resupload > 0)   // $resupload can be 'ErrorFileAlreadyExists'
@@ -1600,10 +1603,10 @@ function dol_add_file_process($upload_dir, $allowoverwrite = 0, $donotupdatesess
 					// Update table of files
 					if ($donotupdatesession == 1)
 					{
-						$result = addFileIntoDatabaseIndex($upload_dir, basename($destfile), $TFile['name'][$i], 'uploaded', 0);
+						$result = addFileIntoDatabaseIndex($upload_dir, basename($destfile).($resupload == 2 ? '.noexe' : ''), $TFile['name'][$i], 'uploaded', 0);
 						if ($result < 0)
 						{
-							setEventMessages('FailedToAddFileIntoDatabaseIndex', '', 'warnings');
+							setEventMessages('WarningFailedToAddFileIntoDatabaseIndex', '', 'warnings');
 						}
 					}
 
@@ -1714,7 +1717,7 @@ function dol_remove_file_process($filenb, $donotupdatesession = 0, $donotdeletef
  *  See also commonGenerateDocument that also add/update database index when a file is generated.
  *
  *  @param      string	$dir			Directory name (full real path without ending /)
- *  @param		string	$file			File name
+ *  @param		string	$file			File name (May end with '.noexe')
  *  @param		string	$fullpathorig	Full path of origin for file (can be '')
  *  @param		string	$mode			How file was created ('uploaded', 'generated', ...)
  *  @param		int		$setsharekey	Set also the share key
@@ -1730,7 +1733,7 @@ function addFileIntoDatabaseIndex($dir, $file, $fullpathorig = '', $mode = 'uplo
 
 	if (!preg_match('/[\\/]temp[\\/]|[\\/]thumbs|\.meta$/', $rel_dir))     // If not a tmp dir
 	{
-		$filename = basename($file);
+		$filename = basename(preg_replace('/\.noexe$/', '', $file));
 		$rel_dir = preg_replace('/[\\/]$/', '', $rel_dir);
 		$rel_dir = preg_replace('/^[\\/]/', '', $rel_dir);
 
diff --git a/htdocs/core/tpl/filemanager.tpl.php b/htdocs/core/tpl/filemanager.tpl.php
index 3a3395432de..f95286bbcfc 100644
--- a/htdocs/core/tpl/filemanager.tpl.php
+++ b/htdocs/core/tpl/filemanager.tpl.php
@@ -178,7 +178,7 @@ if (empty($action) || $action == 'editfile' || $action == 'file_manager' || preg
 
 	    print '</td></tr>';
     }
-    else	// Show filtree when ajax is disabled (rare)
+    else	// Show file tree when ajax is disabled (rare)
     {
         print '<tr><td style="padding-left: 20px">';
 
@@ -212,7 +212,7 @@ if (empty($action) || $action == 'editfile' || $action == 'file_manager' || preg
 <div class="pane-in ecm-in-layout-center">
 <div id="ecmfileview" class="ecmfileview">
 <?php
-// Start right panel
+// Start right panel - List of content of a directory
 
 
 $mode='noajax';
diff --git a/htdocs/ecm/class/ecmfiles.class.php b/htdocs/ecm/class/ecmfiles.class.php
index 01f6228ad83..8f1b2c91d78 100644
--- a/htdocs/ecm/class/ecmfiles.class.php
+++ b/htdocs/ecm/class/ecmfiles.class.php
@@ -138,7 +138,7 @@ class EcmFiles extends CommonObject
 			 $this->entity = trim($this->entity);
 		}
 		if (isset($this->filename)) {
-			 $this->filename = trim($this->filename);
+			 $this->filename = preg_replace('/\.noexe$/', '', trim($this->filename));
 		}
 		if (isset($this->filepath)) {
 			 $this->filepath = trim($this->filepath);
@@ -346,12 +346,13 @@ class EcmFiles extends CommonObject
 		$sql .= " t.src_object_id";
 		$sql .= ' FROM ' . MAIN_DB_PREFIX . $this->table_element . ' as t';
 		$sql.= ' WHERE 1 = 1';
-		/* Fetching this table depends on filepath+filename, it must not depends on entity
+		/* Fetching this table depends on filepath+filename, it must not depends on entity because filesystem on disk does not know what is Dolibarr entities
 		if (! empty($conf->multicompany->enabled)) {
 		    $sql .= " AND entity IN (" . getEntity('ecmfiles') . ")";
 		}*/
 		if ($relativepath) {
-			$sql .= " AND t.filepath = '" . $this->db->escape(dirname($relativepath)) . "' AND t.filename = '".$this->db->escape(basename($relativepath))."'";
+			$relativepathwithnoexe = preg_replace('/\.noexe$/', '', $relativepath);		// We must never have the .noexe into the database
+			$sql .= " AND t.filepath = '" . $this->db->escape(dirname($relativepath)) . "' AND t.filename = '".$this->db->escape(basename($relativepathwithnoexe))."'";
 			$sql .= " AND t.entity = ".$conf->entity;				// unique key include the entity so each company has its own index
 		}
 		elseif (! empty($ref)) {		// hash of file path
@@ -552,46 +553,47 @@ class EcmFiles extends CommonObject
 		// Clean parameters
 
 		if (isset($this->ref)) {
-			 $this->ref = trim($this->ref);
+			$this->ref = trim($this->ref);
 		}
 		if (isset($this->label)) {
-			 $this->label = trim($this->label);
+			$this->label = trim($this->label);
 		}
 		if (isset($this->share)) {
-			 $this->share = trim($this->share);
+			$this->share = trim($this->share);
 		}
 		if (isset($this->entity)) {
-			 $this->entity = trim($this->entity);
+			$this->entity = trim($this->entity);
 		}
 		if (isset($this->filename)) {
-			 $this->filename = trim($this->filename);
+			$this->filename = preg_replace('/\.noexe$/', '', trim($this->filename));
 		}
 		if (isset($this->filepath)) {
-			 $this->filepath = trim($this->filepath);
+			$this->filepath = trim($this->filepath);
+			$this->filepath = preg_replace('/[\\/]+$/', '', $this->filepath);		// Remove last /
 		}
 		if (isset($this->fullpath_orig)) {
-			 $this->fullpath_orig = trim($this->fullpath_orig);
+			$this->fullpath_orig = trim($this->fullpath_orig);
 		}
 		if (isset($this->description)) {
-			 $this->description = trim($this->description);
+			$this->description = trim($this->description);
 		}
 		if (isset($this->keywords)) {
-			 $this->keywords = trim($this->keywords);
+			$this->keywords = trim($this->keywords);
 		}
 		if (isset($this->cover)) {
-			 $this->cover = trim($this->cover);
+			$this->cover = trim($this->cover);
 		}
 		if (isset($this->gen_or_uploaded)) {
-			 $this->gen_or_uploaded = trim($this->gen_or_uploaded);
+			$this->gen_or_uploaded = trim($this->gen_or_uploaded);
 		}
 		if (isset($this->extraparams)) {
-			 $this->extraparams = trim($this->extraparams);
+			$this->extraparams = trim($this->extraparams);
 		}
 		if (isset($this->fk_user_m)) {
-			 $this->fk_user_m = trim($this->fk_user_m);
+			$this->fk_user_m = trim($this->fk_user_m);
 		}
 		if (isset($this->acl)) {
-			 $this->acl = trim($this->acl);
+			$this->acl = trim($this->acl);
 		}
 		if (isset($this->src_object_type)) {
 			$this->src_object_type = trim($this->src_object_type);
diff --git a/htdocs/ecm/file_card.php b/htdocs/ecm/file_card.php
index 3664a2e7f28..e1796068370 100644
--- a/htdocs/ecm/file_card.php
+++ b/htdocs/ecm/file_card.php
@@ -139,6 +139,12 @@ if ($action == 'update')
 
     $oldfile = $olddir.$oldlabel;
     $newfile = $newdir.$newlabel;
+    $newfileformove = $newfile;
+    // If old file end with .noexe, new file must also end with .noexe
+    if (preg_match('/\.noexe$/', $oldfile) && ! preg_match('/\.noexe$/', $newfileformove)) {
+    	$newfileformove .= '.noexe';
+    }
+    //var_dump($oldfile);var_dump($newfile);exit;
 
     // Now we update index of file
     $db->begin();
@@ -146,7 +152,7 @@ if ($action == 'update')
     //print $oldfile.' - '.$newfile;
     if ($newlabel != $oldlabel)
     {
-        $result = dol_move($oldfile, $newfile); // This include update of database
+    	$result = dol_move($oldfile, $newfileformove); // This include update of database
         if (!$result)
         {
             $langs->load('errors');
@@ -190,7 +196,7 @@ if ($action == 'update')
 			$object->entity = $conf->entity;
 			$object->filepath = preg_replace('/[\\/]+$/', '', $newdirrelativetodocument);
 			$object->filename = $newlabel;
-			$object->label = md5_file(dol_osencode($newfile)); // hash of file content
+			$object->label = md5_file(dol_osencode($newfileformove)); // hash of file content
 			$object->fullpath_orig = '';
 			$object->gen_or_uploaded = 'unknown';
 			$object->description = ''; // indexed content
@@ -208,6 +214,11 @@ if ($action == 'update')
         $db->commit();
 
         $urlfile = $newlabel;
+        // If old file end with .noexe, new file must also end with .noexe
+        if (preg_match('/\.noexe$/', $newfileformove)) {
+        	$urlfile .= '.noexe';
+        }
+
         header('Location: '.$_SERVER["PHP_SELF"].'?urlfile='.urlencode($urlfile).'&section='.urlencode($section));
         exit;
     }
@@ -264,9 +275,13 @@ while ($tmpecmdir && $result > 0)
 	$i++;
 }
 
+$urlfiletoshow = preg_replace('/\.noexe$/', '', $urlfile);
+
 $s = img_picto('', 'object_dir').' <a href="'.DOL_URL_ROOT.'/ecm/index.php">'.$langs->trans("ECMRoot").'</a> -> '.$s.' -> ';
-if ($action == 'edit') $s .= '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfile.'">';
-else $s .= $urlfile;
+if ($action == 'edit') $s .= '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfiletoshow.'">';
+else $s .= $urlfiletoshow;
+
+$morehtml = '';
 
 $object->ref = ''; // Force to hide ref
 dol_banner_tab($object, '', $morehtml, 0, '', '', $s);
@@ -289,10 +304,9 @@ print dol_print_size($totalsize);
 print '</td></tr>';
 */
 
+// Hash of file content
 print '<tr><td>'.$langs->trans("HashOfFileContent").'</td><td>';
 $object = new EcmFiles($db);
-//$filenametosearch=basename($filepath);
-//$filedirtosearch=basedir($filepath);
 $object->fetch(0, '', $filepathtodocument);
 if (!empty($object->label))
 {
diff --git a/htdocs/ecm/index.php b/htdocs/ecm/index.php
index e51efb01aaa..852d148e258 100644
--- a/htdocs/ecm/index.php
+++ b/htdocs/ecm/index.php
@@ -124,15 +124,17 @@ if ($action == 'confirm_deletefile')
 	if (GETPOST('confirm') == 'yes')
 	{
 		// GETPOST('urlfile','alpha') is full relative URL from ecm root dir. Contains path of all sections.
-		//var_dump(GETPOST('urlfile'));exit;
 
 		$upload_dir = $conf->ecm->dir_output.($relativepath?'/'.$relativepath:'');
 		$file = $upload_dir . "/" . GETPOST('urlfile', 'alpha');
+		//var_dump($file);exit;
 
 		$ret=dol_delete_file($file);	// This include also the delete from file index in database.
 		if ($ret)
 		{
-			setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile', 'alpha')), null, 'mesgs');
+			$urlfiletoshow = GETPOST('urlfile', 'alpha');
+			$urlfiletoshow = preg_replace('/\.noexe$/', '', $urlfiletoshow);
+			setEventMessages($langs->trans("FileWasRemoved", $urlfiletoshow), null, 'mesgs');
 			$result=$ecmdir->changeNbOfFiles('-');
 		}
 		else
diff --git a/htdocs/langs/en_US/errors.lang b/htdocs/langs/en_US/errors.lang
index c5b61e50ed6..d145e75bad6 100644
--- a/htdocs/langs/en_US/errors.lang
+++ b/htdocs/langs/en_US/errors.lang
@@ -255,3 +255,4 @@ WarningNumberOfRecipientIsRestrictedInMassAction=Warning, number of different re
 WarningDateOfLineMustBeInExpenseReportRange=Warning, the date of line is not in the range of the expense report
 WarningProjectClosed=Project is closed. You must re-open it first.
 WarningSomeBankTransactionByChequeWereRemovedAfter=Some bank transaction were removed after that the receipt including them were generated. So nb of cheques and total of receipt may differ from number and total in list.
+WarningFailedToAddFileIntoDatabaseIndex=Warnin, failed to add file entry into ECM database index table
\ No newline at end of file