diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php index 2a23ee5eb85..21d60103135 100644 --- a/htdocs/accountancy/admin/account.php +++ b/htdocs/accountancy/admin/account.php @@ -399,7 +399,7 @@ if ($resql) { } print ""; print ajax_combobox("chartofaccounts"); - print ''; + print ''; print '
'; @@ -436,7 +436,7 @@ if ($resql) { } if (!empty($arrayfields['aa.account_parent']['checked'])) { print ''; - print $formaccounting->select_account($search_accountparent, 'search_accountparent', 2); + print $formaccounting->select_account($search_accountparent, 'search_accountparent', 2, array(), 0, 0, 'maxwidth150'); print ''; } if (!empty($arrayfields['aa.pcg_type']['checked'])) { diff --git a/htdocs/accountancy/admin/categories.php b/htdocs/accountancy/admin/categories.php index 7b86902e009..87e6a3b490c 100644 --- a/htdocs/accountancy/admin/categories.php +++ b/htdocs/accountancy/admin/categories.php @@ -110,18 +110,22 @@ print ''; // Select the category print ''; print ''; +print '
'.$langs->trans("AccountingCategory").''; -$formaccounting->select_accounting_category($cat_id, 'account_category', 1, 0, 0, 1); -print ''; +$formaccounting->select_accounting_category($cat_id, 'account_category', 1, 0, 0, 0); +print ''; print '
'; + +print dol_get_fiche_end(); + + // Select the accounts if (!empty($cat_id)) { $return = $accountingcategory->getAccountsWithNoCategory($cat_id); if ($return < 0) { setEventMessages(null, $accountingcategory->errors, 'errors'); } - print ''.$langs->trans("AddAccountFromBookKeepingWithNoCategories").''; - print ''; + print '
'; $arraykeyvalue = array(); foreach ($accountingcategory->lines_cptbk as $key => $val) { @@ -130,8 +134,9 @@ if (!empty($cat_id)) { } if (is_array($accountingcategory->lines_cptbk) && count($accountingcategory->lines_cptbk) > 0) { - print $form->multiselectarray('cpt_bk', $arraykeyvalue, GETPOST('cpt_bk', 'array'), null, null, null, null, "90%"); - print '
'; + print img_picto($langs->trans("AccountingAccount"), 'accounting_account', 'class="pictofixedwith"'); + print $form->multiselectarray('cpt_bk', $arraykeyvalue, GETPOST('cpt_bk', 'array'), null, null, '', 0, "80%", '', '', $langs->transnoentitiesnoconv("AddAccountFromBookKeepingWithNoCategories")); + //print '
'; /*print '
'; print ajax_combobox('cpt_bk'); */ - print ' '; + print ' '; } - print ''; } -print ''; - -print dol_get_fiche_end(); - print ''; if ($action == 'display' || $action == 'delete') { - print "\n"; + print '
'; + print '
'."\n"; print ''; print '"; print '"; @@ -177,6 +178,8 @@ if ($action == 'display' || $action == 'delete') { print ""; print "\n"; } + } else { + print ''; } } diff --git a/htdocs/accountancy/admin/categories_list.php b/htdocs/accountancy/admin/categories_list.php index a33616fc09e..0e7bd908c9a 100644 --- a/htdocs/accountancy/admin/categories_list.php +++ b/htdocs/accountancy/admin/categories_list.php @@ -605,7 +605,7 @@ if ($resql) { if ($showfield) { if ($value == 'country') { print ''; $filterfound++; } else { @@ -725,11 +725,11 @@ if ($resql) { print ''; print ''; print ''; print ''; } else { @@ -887,10 +887,10 @@ function fieldListAccountingCategories($fieldlist, $obj = '', $tabname = '', $co if ($context == 'add') { $fieldname = 'country_id'; $preselectcountrycode = GETPOSTISSET('country_id') ? GETPOST('country_id', 'int') : $mysoc->country_code; - print $form->select_country($preselectcountrycode, $fieldname, '', 28, 'maxwidth200 maxwidthonsmartphone'); + print $form->select_country($preselectcountrycode, $fieldname, '', 28, 'maxwidth150 maxwidthonsmartphone'); } else { $preselectcountrycode = (empty($obj->country_code) ? (empty($obj->country) ? $mysoc->country_code : $obj->country) : $obj->country_code); - print $form->select_country($preselectcountrycode, $fieldname, '', 28, 'maxwidth200 maxwidthonsmartphone'); + print $form->select_country($preselectcountrycode, $fieldname, '', 28, 'maxwidth150 maxwidthonsmartphone'); } print ''; } elseif ($fieldlist[$field] == 'country_id') { diff --git a/htdocs/core/class/html.formaccounting.class.php b/htdocs/core/class/html.formaccounting.class.php index 19ef75c8aaa..8ebac3611cb 100644 --- a/htdocs/core/class/html.formaccounting.class.php +++ b/htdocs/core/class/html.formaccounting.class.php @@ -270,12 +270,16 @@ class FormAccounting extends Form } while ($i < $num) { $obj = $this->db->fetch_object($resql); + + $titletoshowhtml = ($maxlen ? dol_trunc($obj->type, $maxlen) : $obj->type).($obj->range_account ? ' ('.$obj->range_account.')' : ''); + $titletoshow = ($maxlen ? dol_trunc($obj->type, $maxlen) : $obj->type).($obj->range_account ? ' ('.$obj->range_account.')' : ''); + $out .= ''; $i++; diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index ca7e346b2bd..24e4a332e10 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -6914,24 +6914,27 @@ function dol_string_nohtmltag($stringtoclean, $removelinefeed = 1, $pagecodeto = /** * Clean a string to keep only desirable HTML tags. - * WARNING: This also clean HTML comments (used to obfuscate tag name). + * WARNING: This also clean HTML comments (because they can be used to obfuscate tag name). * * @param string $stringtoclean String to clean * @param int $cleanalsosomestyles Remove absolute/fixed positioning from inline styles * @param int $removeclassattribute 1=Remove the class attribute from tags * @param int $cleanalsojavascript Remove also occurence of 'javascript:'. * @param int $allowiframe Allow iframe tags. + * @param array $allowed_tags List of allowed tags to replace the default list * @return string String cleaned * * @see dol_escape_htmltag() strip_tags() dol_string_nohtmltag() dol_string_neverthesehtmltags() */ -function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $removeclassattribute = 1, $cleanalsojavascript = 0, $allowiframe = 0) +function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $removeclassattribute = 1, $cleanalsojavascript = 0, $allowiframe = 0, $allowed_tags = array()) { - $allowed_tags = array( - "html", "head", "meta", "body", "article", "a", "abbr", "b", "blockquote", "br", "cite", "div", "dl", "dd", "dt", "em", "font", "img", "ins", "hr", "i", "li", "link", - "ol", "p", "q", "s", "section", "span", "strike", "strong", "title", "table", "tr", "th", "td", "u", "ul", "sup", "sub", "blockquote", "pre", "h1", "h2", "h3", "h4", "h5", "h6", - "comment" // this tags is added to manage comment that are replaced into ... - ); + if (empty($allowed_tags)) { + $allowed_tags = array( + "html", "head", "meta", "body", "article", "a", "abbr", "b", "blockquote", "br", "cite", "div", "dl", "dd", "dt", "em", "font", "img", "ins", "hr", "i", "li", "link", + "ol", "p", "q", "s", "section", "span", "strike", "strong", "title", "table", "tr", "th", "td", "u", "ul", "sup", "sub", "blockquote", "pre", "h1", "h2", "h3", "h4", "h5", "h6" + ); + } + $allowed_tags[] = "comment"; // this tags is added to manage comment that are replaced into ... if ($allowiframe) { $allowed_tags[] = "iframe"; } @@ -6949,7 +6952,7 @@ function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $stringtoclean = preg_replace('/:/i', ':', $stringtoclean); $stringtoclean = preg_replace('/:|�+58|:/i', '', $stringtoclean); // refused string ':' encoded (no reason to have a : encoded like this) to disable 'javascript:...' - $temp = strip_tags($stringtoclean, $allowed_tags_string); // Warning: This remove also undesired changing string obfuscated with that pass injection detection into harmfull string + $temp = strip_tags($stringtoclean, $allowed_tags_string); // Warning: This remove also undesired , so may changes string obfuscated with that pass the injection detection into a harmfull string if ($cleanalsosomestyles) { // Clean for remaining html tags $temp = preg_replace('/position\s*:\s*(absolute|fixed)\s*!\s*important/i', '', $temp); // Note: If hacker try to introduce css comment into string to bypass this regex, the string must also be encoded by the dol_htmlentitiesbr during output so it become harmless
'.$langs->trans("AccountAccounting")."'.$langs->trans("Label")."
'.$langs->trans("NoRecordFound").'
'; - print $form->select_country($search_country_id, 'search_country_id', '', 28, 'maxwidth200 maxwidthonsmartphone'); + print $form->select_country($search_country_id, 'search_country_id', '', 28, 'maxwidth150 maxwidthonsmartphone'); print ''; + print '
'; print ''; print ''; - print ''; - print '
'; - print ''; + print ''; + print ''; print '