diff --git a/ChangeLog b/ChangeLog
index 7bfd43947b6..1f4afc83e82 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,7 @@ Following changes may create regressions for some external modules, but were nec
* Property num_paiement has been renamed num_payment everywhere for better code consistency.
* If you build a class that implement CommonObject to use the incoterm properties or method (->fk_incoterm, ->label_incoterm, ->location_incoterm),
you must now also include declaration of the Trait CommonIncoterm in your class. All incoterm functions were moved into this Trait.
+* The GETPOST(..., 'alpha') has now the same behaviour than GETPOST(..., 'alpahnohtml');
***** ChangeLog for 12.0.2 compared to 12.0.1 *****
FIX: computation of the bottom margin of returns NaN because body is not loaded yet
diff --git a/SECURITY.md b/SECURITY.md
index 59311cf71ba..06d1407229a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -62,13 +62,19 @@ No vulnerability disclosure, including partial is allowed for the moment.
## Scope for qualified vulnerabilities
-ONLY vulnerabilities discovered, when the following setup on tested platform is used, are accepted:
+ONLY vulnerabilities discovered, when the following setup on test platform is used, are accepted:
* $dolibarr_main_prod must be set to 1 into conf.php
-* $dolibarr_nocsrfcheck must be kept to the value 1 into conf.php (this is the default value)
-* The module DebugBar must NOT be enabled (by default, this module is not enabled)
+* $dolibarr_nocsrfcheck must be kept to the value 0 into conf.php (this is the default value)
+* $dolibarr_main_force_https must be set to something else than 0.
* The constant MAIN_SECURITY_CSRF_WITH_TOKEN must be set to 1 into backoffice menu Home - Setup - Other (this protection should be enabled soon by default)
-* ONLY security reports on "stable" modules are allowed (troubles into "experimental" and "developement" modules are not accepted).
+* The module DebugBar must NOT be enabled (by default, this module is not enabled. This is a developer tool)
+* The module ModuleBuilder must NOT be enabled (by default, this module is not enabled. This is a developer tool)
+* ONLY security reports on modules provided by default and with the "stable" status are allowed (troubles into "experimental", "developement" or external modules are not accepted).
+* The root of web server must link to htdocs and the documents directory must be outside of the web server root (this is the default when using the default installer but may differs with external installer).
+* The web server setup must be done so only the documents directory is in write mode. The root directory called htdocs must be readonly.
+* CSRF attacks are accepted for all when using a POST URL, but are accepted only for creating or updating data resctricted to the admin user when using GET URL.
+* Ability for a high level user to edit web site pages in the CMS by including javascript is an expected feature.
Scope is the web application (back office) and the APIs.
diff --git a/dev/initdemo/initdemo.sh b/dev/initdemo/initdemo.sh
index 7fd9eb551d4..1b32161b44b 100755
--- a/dev/initdemo/initdemo.sh
+++ b/dev/initdemo/initdemo.sh
@@ -69,6 +69,7 @@ then
255)
exit;;
esac
+ rm $fichtemp
# ----------------------------- database name
DIALOG=${DIALOG=dialog}
@@ -86,6 +87,7 @@ then
255)
exit;;
esac
+ rm $fichtemp
# ---------------------------- database port
DIALOG=${DIALOG=dialog}
@@ -104,6 +106,7 @@ then
255)
exit;;
esac
+ rm $fichtemp
# ---------------------------- compte admin mysql
DIALOG=${DIALOG=dialog}
@@ -122,6 +125,7 @@ then
255)
exit;;
esac
+ rm $fichtemp
# ---------------------------- mot de passe admin mysql
DIALOG=${DIALOG=dialog}
@@ -140,6 +144,7 @@ then
255)
exit;;
esac
+ rm $fichtemp
export documentdir=`cat $mydir/../../htdocs/conf/conf.php | grep '^\$dolibarr_main_data_root' | sed -e 's/$dolibarr_main_data_root=//' | sed -e 's/;//' | sed -e "s/'//g" | sed -e 's/"//g' `
diff --git a/dev/initdemo/initdemopassword.sh b/dev/initdemo/initdemopassword.sh
new file mode 100755
index 00000000000..d5aa9c1ef0e
--- /dev/null
+++ b/dev/initdemo/initdemopassword.sh
@@ -0,0 +1,166 @@
+#!/bin/sh
+#------------------------------------------------------
+# Script to reinit admin password.
+# Note: "dialog" tool need to be available if no parameter provided.
+#
+# Laurent Destailleur - eldy@users.sourceforge.net
+#------------------------------------------------------
+# Usage: initdemopassword.sh confirm
+# usage: initdemopassword.sh confirm base port login pass
+#------------------------------------------------------
+
+
+export mydir=`echo "$0" | sed -e 's/initdemopassword.sh//'`;
+if [ "x$mydir" = 'x' -o "x$mydir" = 'x./' ]
+then
+ export mydir="."
+fi
+export id=`id -u`;
+
+
+# ----------------------------- check if root
+if [ "x$id" != "x0" -a "x$id" != "x1001" ]
+then
+ echo "Script must be ran as root"
+ exit
+fi
+
+
+# ----------------------------- command line params
+confirm=$1;
+base=$2;
+port=$3;
+demologin=$4;
+demopass=$5;
+
+# ----------------------------- check params
+if [ "x$confirm" != "xconfirm" ]
+then
+ echo "----- $0 -----"
+ echo "Usage: initdemopassword.sh confirm [base port login pass]"
+ exit
+fi
+
+
+# ----------------------------- if no params on command line
+if [ "x$demopass" = "x" ]
+then
+ export dumpfile=`ls -v $mydir/mysqldump_dolibarr_*.sql | tail -n 1`
+ export dumpfile=`basename $dumpfile`
+
+ # ----------------------------- database name
+ DIALOG=${DIALOG=dialog}
+ DIALOG="$DIALOG --ascii-lines"
+ fichtemp=`tempfile 2>/dev/null` || fichtemp=/tmp/test$$
+ trap "rm -f $fichtemp" 0 1 2 5 15
+ $DIALOG --title "Init Dolibarr with demo values" --clear \
+ --inputbox "Mysql database name :" 16 55 dolibarrdemo 2> $fichtemp
+ valret=$?
+ case $valret in
+ 0)
+ base=`cat $fichtemp`;;
+ 1)
+ exit;;
+ 255)
+ exit;;
+ esac
+ rm $fichtemp
+
+ # ---------------------------- database port
+ DIALOG=${DIALOG=dialog}
+ fichtemp=`tempfile 2>/dev/null` || fichtemp=/tmp/test$$
+ trap "rm -f $fichtemp" 0 1 2 5 15
+ $DIALOG --title "Init Dolibarr with demo values" --clear \
+ --inputbox "Mysql port (ex: 3306):" 16 55 3306 2> $fichtemp
+
+ valret=$?
+
+ case $valret in
+ 0)
+ port=`cat $fichtemp`;;
+ 1)
+ exit;;
+ 255)
+ exit;;
+ esac
+ rm $fichtemp
+
+
+ # ----------------------------- demo login
+ DIALOG=${DIALOG=dialog}
+ DIALOG="$DIALOG --ascii-lines"
+ fichtemp=`tempfile 2>/dev/null` || fichtemp=/tmp/test$$
+ trap "rm -f $fichtemp" 0 1 2 5 15
+ $DIALOG --title "Reset login password" --clear \
+ --inputbox "Login to reset :" 16 55 dolibarrdemologin 2> $fichtemp
+ valret=$?
+ case $valret in
+ 0)
+ demologin=`cat $fichtemp`;;
+ 1)
+ exit;;
+ 255)
+ exit;;
+ esac
+ rm fichtemp
+
+ # ----------------------------- demo pass
+ DIALOG=${DIALOG=dialog}
+ DIALOG="$DIALOG --ascii-lines"
+ fichtemp=`tempfile 2>/dev/null` || fichtemp=/tmp/test$$
+ trap "rm -f $fichtemp" 0 1 2 5 15
+ $DIALOG --title "Reset login password" --clear \
+ --inputbox "Pass to set :" 16 55 dolibarrdemopass 2> $fichtemp
+ valret=$?
+ case $valret in
+ 0)
+ demopass=`cat $fichtemp`;;
+ 1)
+ exit;;
+ 255)
+ exit;;
+ esac
+ rm fichtemp
+
+
+ export documentdir=`cat $mydir/../../htdocs/conf/conf.php | grep '^\$dolibarr_main_data_root' | sed -e 's/$dolibarr_main_data_root=//' | sed -e 's/;//' | sed -e "s/'//g" | sed -e 's/"//g' `
+
+
+ # ---------------------------- confirmation
+ DIALOG=${DIALOG=dialog}
+ $DIALOG --title "Init demo login with demo values" --clear \
+ --yesno "Do you confirm ? \n Mysql database : '$base' \n Mysql port : '$port' \n Demo login: '$demologin' \n Demo password : '$demopass'" 15 55
+
+ case $? in
+ 0) echo "Ok, start process...";;
+ 1) exit;;
+ 255) exit;;
+ esac
+
+fi
+
+
+# ---------------------------- run sql file
+if [ "x$passwd" != "x" ]
+then
+ export passwd="-p$passwd"
+fi
+#echo "mysql -P$port -u$admin $passwd $base < $mydir/$dumpfile"
+#mysql -P$port -u$admin $passwd $base < $mydir/$dumpfile
+echo "echo \"UPDATE llx_user SET pass_crypted = MD5('$demopass') WHERE login = '$demologin';\" | mysql -P$port $base"
+echo "UPDATE llx_user SET pass_crypted = MD5('$demopass') WHERE login = '$demologin';" | mysql -P$port $base
+export res=$?
+
+if [ $res -ne 0 ]; then
+ echo "Error to execute sql with mysql -P$port -u$admin -p***** $base"
+ exit
+fi
+
+
+if [ "x$res" = "x0" ]
+then
+ echo "Success, file successfully loaded."
+else
+ echo "Error, load failed."
+fi
+echo
diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php
index e6264648159..93241901524 100644
--- a/htdocs/accountancy/admin/account.php
+++ b/htdocs/accountancy/admin/account.php
@@ -55,7 +55,7 @@ if (!$user->rights->accounting->chartofaccount) accessforbidden();
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/accountancy/admin/fiscalyear.php b/htdocs/accountancy/admin/fiscalyear.php
index 89aad6e2d0d..5728f78b791 100644
--- a/htdocs/accountancy/admin/fiscalyear.php
+++ b/htdocs/accountancy/admin/fiscalyear.php
@@ -30,7 +30,7 @@ $action = GETPOST('action', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/accountancy/bookkeeping/balance.php b/htdocs/accountancy/bookkeeping/balance.php
index a5000dda461..9079d95d670 100644
--- a/htdocs/accountancy/bookkeeping/balance.php
+++ b/htdocs/accountancy/bookkeeping/balance.php
@@ -47,7 +47,7 @@ $action = GETPOST('action', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/accountancy/bookkeeping/list.php b/htdocs/accountancy/bookkeeping/list.php
index 987f7f3fd28..f8f0cad1996 100644
--- a/htdocs/accountancy/bookkeeping/list.php
+++ b/htdocs/accountancy/bookkeeping/list.php
@@ -92,7 +92,7 @@ $search_not_reconciled = GETPOST('search_reconciled_option', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) { $page = 0; }
$offset = $limit * $page;
diff --git a/htdocs/accountancy/bookkeeping/listbyaccount.php b/htdocs/accountancy/bookkeeping/listbyaccount.php
index e5a18626b42..6e7b9dfb54f 100644
--- a/htdocs/accountancy/bookkeeping/listbyaccount.php
+++ b/htdocs/accountancy/bookkeeping/listbyaccount.php
@@ -39,7 +39,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("accountancy"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$search_date_start = dol_mktime(0, 0, 0, GETPOST('search_date_startmonth', 'int'), GETPOST('search_date_startday', 'int'), GETPOST('search_date_startyear', 'int'));
$search_date_end = dol_mktime(0, 0, 0, GETPOST('search_date_endmonth', 'int'), GETPOST('search_date_endday', 'int'), GETPOST('search_date_endyear', 'int'));
$search_doc_date = dol_mktime(0, 0, 0, GETPOST('doc_datemonth', 'int'), GETPOST('doc_dateday', 'int'), GETPOST('doc_dateyear', 'int'));
@@ -69,7 +69,7 @@ if (GETPOST("button_delmvt_x") || GETPOST("button_delmvt.x") || GETPOST("button_
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) { $page = 0; }
$offset = $limit * $page;
diff --git a/htdocs/accountancy/customer/card.php b/htdocs/accountancy/customer/card.php
index 34a23b377b9..ed8f347a177 100644
--- a/htdocs/accountancy/customer/card.php
+++ b/htdocs/accountancy/customer/card.php
@@ -30,7 +30,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formaccounting.class.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "accountancy"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/accountancy/customer/lines.php b/htdocs/accountancy/customer/lines.php
index 6b326ec872f..2baed5d4653 100644
--- a/htdocs/accountancy/customer/lines.php
+++ b/htdocs/accountancy/customer/lines.php
@@ -62,7 +62,7 @@ $search_tvaintra = GETPOST('search_tvaintra', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) $page = 0;
$offset = $limit * $page;
diff --git a/htdocs/accountancy/customer/list.php b/htdocs/accountancy/customer/list.php
index 96750389cc0..79a693978d1 100644
--- a/htdocs/accountancy/customer/list.php
+++ b/htdocs/accountancy/customer/list.php
@@ -40,7 +40,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "companies", "compta", "accountancy", "other", "productbatch"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
@@ -70,7 +70,7 @@ $btn_ventil = GETPOST('ventil', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) { $page = 0; }
$offset = $limit * $page;
diff --git a/htdocs/accountancy/expensereport/card.php b/htdocs/accountancy/expensereport/card.php
index b21882b9461..ab02592f6b8 100644
--- a/htdocs/accountancy/expensereport/card.php
+++ b/htdocs/accountancy/expensereport/card.php
@@ -34,7 +34,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formaccounting.class.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "accountancy", "trips"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/accountancy/expensereport/lines.php b/htdocs/accountancy/expensereport/lines.php
index 4fdc29b2c0f..afb6ae13a6e 100644
--- a/htdocs/accountancy/expensereport/lines.php
+++ b/htdocs/accountancy/expensereport/lines.php
@@ -56,7 +56,7 @@ $search_year = GETPOST("search_year", "int");
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) $page = 0;
$pageprev = $page - 1;
diff --git a/htdocs/accountancy/expensereport/list.php b/htdocs/accountancy/expensereport/list.php
index 76d13b99805..61e2a95fd88 100644
--- a/htdocs/accountancy/expensereport/list.php
+++ b/htdocs/accountancy/expensereport/list.php
@@ -38,7 +38,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "companies", "compta", "accountancy", "other", "trips", "productbatch", "hrm"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
@@ -66,7 +66,7 @@ $search_year = GETPOST("search_year", "int");
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) { $page = 0; }
$offset = $limit * $page;
diff --git a/htdocs/accountancy/supplier/card.php b/htdocs/accountancy/supplier/card.php
index 07f3117c266..4a4747cfaf4 100644
--- a/htdocs/accountancy/supplier/card.php
+++ b/htdocs/accountancy/supplier/card.php
@@ -34,7 +34,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formaccounting.class.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "accountancy"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/accountancy/supplier/lines.php b/htdocs/accountancy/supplier/lines.php
index 6a5e234532c..dacca2a226d 100644
--- a/htdocs/accountancy/supplier/lines.php
+++ b/htdocs/accountancy/supplier/lines.php
@@ -63,7 +63,7 @@ $search_tvaintra = GETPOST('search_tvaintra', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) $page = 0;
$offset = $limit * $page;
diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php
index 9e0b64160e1..9b700aeac56 100644
--- a/htdocs/accountancy/supplier/list.php
+++ b/htdocs/accountancy/supplier/list.php
@@ -40,7 +40,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("bills", "companies", "compta", "accountancy", "other", "productbatch"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
@@ -70,7 +70,7 @@ $btn_ventil = GETPOST('ventil', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : (empty($conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION) ? $conf->liste_limit : $conf->global->ACCOUNTING_LIMIT_LIST_VENTILATION);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0) { $page = 0; }
$offset = $limit * $page;
diff --git a/htdocs/adherents/admin/adherent.php b/htdocs/adherents/admin/adherent.php
index ca1d1cc2a33..f2c52daa4b0 100644
--- a/htdocs/adherents/admin/adherent.php
+++ b/htdocs/adherents/admin/adherent.php
@@ -41,7 +41,7 @@ if (!$user->admin) accessforbidden();
$type = array('yesno', 'texte', 'chaine');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/adherents/admin/adherent_emails.php b/htdocs/adherents/admin/adherent_emails.php
index 1b26a029a01..a3550e4a35a 100644
--- a/htdocs/adherents/admin/adherent_emails.php
+++ b/htdocs/adherents/admin/adherent_emails.php
@@ -41,7 +41,7 @@ if (!$user->admin) accessforbidden();
$oldtypetonewone = array('texte'=>'text', 'chaine'=>'string'); // old type to new ones
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$error = 0;
@@ -83,9 +83,9 @@ if ($action == 'update' || $action == 'add') {
$constlineid = GETPOST('rowid', 'int');
$constname = GETPOST('constname', 'alpha');
- $constvalue = (GETPOSTISSET('constvalue_'.$constname) ? GETPOST('constvalue_'.$constname, 'alpha') : GETPOST('constvalue'));
+ $constvalue = (GETPOSTISSET('constvalue_'.$constname) ? GETPOST('constvalue_'.$constname, 'alphanohtml') : GETPOST('constvalue'));
$consttype = (GETPOSTISSET('consttype_'.$constname) ? GETPOST('consttype_'.$constname, 'alphanohtml') : GETPOST('consttype'));
- $constnote = (GETPOSTISSET('constnote_'.$constname) ? GETPOST('constnote_'.$constname, 'none') : GETPOST('constnote'));
+ $constnote = (GETPOSTISSET('constnote_'.$constname) ? GETPOST('constnote_'.$constname, 'restricthtml') : GETPOST('constnote'));
$typetouse = empty($oldtypetonewone[$consttype]) ? $consttype : $oldtypetonewone[$consttype];
$constvalue = preg_replace('/:member$/', '', $constvalue);
diff --git a/htdocs/adherents/admin/adherent_extrafields.php b/htdocs/adherents/admin/adherent_extrafields.php
index d3d91ecba09..8ca29286cab 100644
--- a/htdocs/adherents/admin/adherent_extrafields.php
+++ b/htdocs/adherents/admin/adherent_extrafields.php
@@ -39,7 +39,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'adherent'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/adherents/admin/adherent_type_extrafields.php b/htdocs/adherents/admin/adherent_type_extrafields.php
index fe7989a70b9..5546a99a334 100644
--- a/htdocs/adherents/admin/adherent_type_extrafields.php
+++ b/htdocs/adherents/admin/adherent_type_extrafields.php
@@ -42,7 +42,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'adherent_type'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/adherents/admin/website.php b/htdocs/adherents/admin/website.php
index 0dbb998f764..64f16f8ef57 100644
--- a/htdocs/adherents/admin/website.php
+++ b/htdocs/adherents/admin/website.php
@@ -33,7 +33,7 @@ require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent_type.class.php';
// Load translation files required by the page
$langs->loadLangs(array("admin", "members"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if (!$user->admin) accessforbidden();
diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php
index cf1614bbb6e..d7a05a1805e 100644
--- a/htdocs/adherents/card.php
+++ b/htdocs/adherents/card.php
@@ -45,7 +45,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
// Load translation files required by the page
$langs->loadLangs(array("companies", "bills", "members", "users", "other", "paypal"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
@@ -82,7 +82,7 @@ if (!empty($canvas)) {
}
// Security check
-$result = restrictedArea($user, 'adherent', $id, '', '', 'socid', 'rowid', $objcanvas);
+$result = restrictedArea($user, 'adherent', $id, '', '', 'socid', 'rowid', 0);
if ($id > 0) {
// Load member
@@ -254,7 +254,7 @@ if (empty($reshook)) {
$object->firstname = trim(GETPOST("firstname", 'alphanohtml'));
$object->lastname = trim(GETPOST("lastname", 'alphanohtml'));
$object->gender = trim(GETPOST("gender", 'alphanohtml'));
- $object->login = trim(GETPOST("login", 'alpha'));
+ $object->login = trim(GETPOST("login", 'alphanohtml'));
$object->pass = trim(GETPOST("pass", 'alpha'));
$object->societe = trim(GETPOST("societe", 'alphanohtml')); // deprecated
@@ -404,10 +404,9 @@ if (empty($reshook)) {
// $facebook=GETPOST("member_facebook", 'alpha');
// $linkedin=GETPOST("member_linkedin", 'alpha');
$email = preg_replace('/\s+/', '', GETPOST("member_email", 'alpha'));
- $login = GETPOST("member_login", 'alpha');
+ $login = GETPOST("member_login", 'alphanohtml');
$pass = GETPOST("password", 'alpha');
$photo = GETPOST("photo", 'alpha');
- //$comment=GETPOST("comment",'none');
$morphy = GETPOST("morphy", 'alphanohtml');
$public = GETPOST("public", 'alphanohtml');
@@ -836,7 +835,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) {
// Login
if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED)) {
- print ''.$langs->trans("Login").' / '.$langs->trans("Id").' '.$langs->trans("Login").' / '.$langs->trans("Id").' '.$langs->trans("Login").' / '.$langs->trans("Id").' '.$langs->trans("Login").' / '.$langs->trans("Id").' '.$langs->trans("Note").' ';
-print ' ';
+print '';
print '';
print '';
diff --git a/htdocs/admin/agenda.php b/htdocs/admin/agenda.php
index 1a29595a9ab..2cc79be297d 100644
--- a/htdocs/admin/agenda.php
+++ b/htdocs/admin/agenda.php
@@ -34,7 +34,7 @@ if (!$user->admin)
// Load translation files required by the page
$langs->loadLangs(array('admin', 'other', 'agenda'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$search_event = GETPOST('search_event', 'alpha');
diff --git a/htdocs/admin/agenda_extrafields.php b/htdocs/admin/agenda_extrafields.php
index a0197f70274..605f3c76519 100644
--- a/htdocs/admin/agenda_extrafields.php
+++ b/htdocs/admin/agenda_extrafields.php
@@ -45,7 +45,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'actioncomm'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/agenda_other.php b/htdocs/admin/agenda_other.php
index 560226438c3..cd7e1752274 100644
--- a/htdocs/admin/agenda_other.php
+++ b/htdocs/admin/agenda_other.php
@@ -37,7 +37,7 @@ if (!$user->admin)
// Load translation files required by the page
$langs->loadLangs(array('admin', 'other', 'agenda', 'users'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$param = GETPOST('param', 'alpha');
$cancel = GETPOST('cancel', 'alpha');
diff --git a/htdocs/admin/agenda_reminder.php b/htdocs/admin/agenda_reminder.php
index 5d23bbb08a1..982387b2ed6 100644
--- a/htdocs/admin/agenda_reminder.php
+++ b/htdocs/admin/agenda_reminder.php
@@ -32,7 +32,7 @@ if (!$user->admin)
// Load translation files required by the page
$langs->loadLangs(array("admin", "other", "agenda"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$param = GETPOST('param', 'alpha');
$cancel = GETPOST('cancel', 'alpha');
diff --git a/htdocs/admin/bank.php b/htdocs/admin/bank.php
index b43daca20d9..76df9b412ec 100644
--- a/htdocs/admin/bank.php
+++ b/htdocs/admin/bank.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array("admin", "companies", "bills", "other", "banks"));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$actionsave = GETPOST('save', 'alpha');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
diff --git a/htdocs/admin/bank_extrafields.php b/htdocs/admin/bank_extrafields.php
index 940e0a7313e..312da228f50 100644
--- a/htdocs/admin/bank_extrafields.php
+++ b/htdocs/admin/bank_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'bank_account'; //Must be the $element of the class that manage extrafield
diff --git a/htdocs/admin/barcode.php b/htdocs/admin/barcode.php
index 250e2cf6162..975869c1ff0 100644
--- a/htdocs/admin/barcode.php
+++ b/htdocs/admin/barcode.php
@@ -33,7 +33,7 @@ $langs->load("admin");
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/admin/bom.php b/htdocs/admin/bom.php
index 621a994cabe..1f19cb75b77 100644
--- a/htdocs/admin/bom.php
+++ b/htdocs/admin/bom.php
@@ -32,7 +32,7 @@ $langs->loadLangs(array('admin', 'errors', 'mrp', 'other'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -151,7 +151,7 @@ elseif ($action == 'setdoc')
}
} elseif ($action == 'set_BOM_FREE_TEXT')
{
- $freetext = GETPOST("BOM_FREE_TEXT", 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST("BOM_FREE_TEXT", 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "BOM_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/bom_extrafields.php b/htdocs/admin/bom_extrafields.php
index 70303f1dcda..7ec50d9d7db 100644
--- a/htdocs/admin/bom_extrafields.php
+++ b/htdocs/admin/bom_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'bom_bom';
diff --git a/htdocs/admin/boxes.php b/htdocs/admin/boxes.php
index 8f28addc994..412427494e3 100644
--- a/htdocs/admin/boxes.php
+++ b/htdocs/admin/boxes.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array('admin', 'boxes', 'accountancy'));
if (!$user->admin) accessforbidden();
$rowid = GETPOST('rowid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Define possible position of boxes
diff --git a/htdocs/admin/chequereceipts.php b/htdocs/admin/chequereceipts.php
index b619f584736..096ffbe02c8 100644
--- a/htdocs/admin/chequereceipts.php
+++ b/htdocs/admin/chequereceipts.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array("admin", "companies", "bills", "other", "banks"));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
@@ -72,7 +72,7 @@ if ($action == 'setmod')
if ($action == 'set_BANK_CHEQUERECEIPT_FREE_TEXT')
{
- $freetext = GETPOST('BANK_CHEQUERECEIPT_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('BANK_CHEQUERECEIPT_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "BANK_CHEQUERECEIPT_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/commande.php b/htdocs/admin/commande.php
index febddf901c5..9add7675da6 100644
--- a/htdocs/admin/commande.php
+++ b/htdocs/admin/commande.php
@@ -41,7 +41,7 @@ $langs->loadLangs(array('admin', 'errors', 'orders', 'other'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -160,7 +160,7 @@ elseif ($action == 'setdoc')
}
} elseif ($action == 'set_ORDER_FREE_TEXT')
{
- $freetext = GETPOST("ORDER_FREE_TEXT", 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST("ORDER_FREE_TEXT", 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "ORDER_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/commande_fournisseur_dispatch_extrafields.php b/htdocs/admin/commande_fournisseur_dispatch_extrafields.php
index 8d5925e363d..e1ec33c02d4 100644
--- a/htdocs/admin/commande_fournisseur_dispatch_extrafields.php
+++ b/htdocs/admin/commande_fournisseur_dispatch_extrafields.php
@@ -50,7 +50,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->trans($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'commande_fournisseur_dispatch'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/company.php b/htdocs/admin/company.php
index e5c20f647e5..8211fd1cadf 100644
--- a/htdocs/admin/company.php
+++ b/htdocs/admin/company.php
@@ -100,7 +100,7 @@ if (($action == 'update' && !GETPOST("cancel", 'alpha'))
dolibarr_set_const($db, "MAIN_INFO_SOCIETE_FAX", GETPOST("fax", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_INFO_SOCIETE_MAIL", GETPOST("mail", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_INFO_SOCIETE_WEB", GETPOST("web", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
- dolibarr_set_const($db, "MAIN_INFO_SOCIETE_NOTE", GETPOST("note", 'none'), 'chaine', 0, '', $conf->entity);
+ dolibarr_set_const($db, "MAIN_INFO_SOCIETE_NOTE", GETPOST("note", 'restricthtml'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_INFO_SOCIETE_GENCOD", GETPOST("barcode", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
$dirforimage = $conf->mycompany->dir_output.'/logos/';
@@ -524,7 +524,7 @@ print '';
// Note
print ''.$langs->trans("Note").' ';
-print ' '.$langs->trans('MainMenuCode').' ';
- print '';
print $langs->trans("Example").': mytopmenukey';
print ' '.$parent_rowid.' ';
} else {
- print ''.$langs->trans('DetailMenuIdParent');
print ', '.$langs->trans("Example").': fk_mainmenu=abc&fk_leftmenu=def';
print ' ';
// Title
- print ''.$langs->trans('Title').' '.$langs->trans('DetailTitre').' '.$langs->trans('Title').' '.$langs->trans('DetailTitre').' '.$langs->trans('URL').' '.$langs->trans('DetailUrl').' '.$langs->trans('URL').' '.$langs->trans('DetailUrl').' '.$langs->trans('LangFile').' '.$langs->trans('DetailLangs').' '.$langs->trans('Position').' '.$langs->trans('DetailPosition').' '.$langs->trans('Position').' '.$langs->trans('DetailPosition').' '.$langs->trans('Target').' ';
@@ -389,10 +389,10 @@ if ($action == 'create')
print ' '.$langs->trans('DetailTarget').' '.$langs->trans('Enabled').' '.$langs->trans('DetailEnabled').' '.$langs->trans('Enabled').' '.$langs->trans('DetailEnabled').' '.$langs->trans('Rights').' '.$langs->trans('DetailRight').' '.$langs->trans('Rights').' '.$langs->trans('DetailRight').' ';
print $langs->trans("Example").': mytopmenukey';
diff --git a/htdocs/admin/menus/index.php b/htdocs/admin/menus/index.php
index 095905afe8b..101e57970c0 100644
--- a/htdocs/admin/menus/index.php
+++ b/htdocs/admin/menus/index.php
@@ -42,7 +42,7 @@ foreach ($dirmenus as $dirmenu)
$dirsmartphone[] = $dirmenu.'smartphone';
}
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$menu_handler_top = $conf->global->MAIN_MENU_STANDARD;
diff --git a/htdocs/admin/menus/other.php b/htdocs/admin/menus/other.php
index 2fad8491e7a..cd8c7cccfa6 100644
--- a/htdocs/admin/menus/other.php
+++ b/htdocs/admin/menus/other.php
@@ -29,7 +29,7 @@ $langs->loadLangs(array("user", "other", "admin"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/admin/modulehelp.php b/htdocs/admin/modulehelp.php
index 2e256f3c5ad..c788eca01d3 100644
--- a/htdocs/admin/modulehelp.php
+++ b/htdocs/admin/modulehelp.php
@@ -34,7 +34,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
$langs->loadLangs(array('errors', 'admin', 'modulebuilder'));
$mode = GETPOST('mode', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('id', 'int');
if (empty($mode)) $mode = 'desc';
diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php
index 3c525200442..38cfe37265b 100644
--- a/htdocs/admin/modules.php
+++ b/htdocs/admin/modules.php
@@ -40,7 +40,7 @@ $langs->loadLangs(array("errors", "admin", "modulebuilder"));
$mode = GETPOSTISSET('mode') ? GETPOST('mode', 'alpha') : (empty($conf->global->MAIN_MODULE_SETUP_ON_LIST_BY_DEFAULT) ? 'commonkanban' : 'common');
if (empty($mode)) $mode = 'common';
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
//var_dump($_POST);exit;
$value = GETPOST('value', 'alpha');
$page_y = GETPOST('page_y', 'int');
diff --git a/htdocs/admin/mrp.php b/htdocs/admin/mrp.php
index 2ea4853e3ca..ffa4d8e7c6b 100644
--- a/htdocs/admin/mrp.php
+++ b/htdocs/admin/mrp.php
@@ -33,7 +33,7 @@ $langs->loadLangs(array('admin', 'errors', 'mrp', 'other'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -152,7 +152,7 @@ elseif ($action == 'setdoc')
}
} elseif ($action == 'set_MRP_MO_FREE_TEXT')
{
- $freetext = GETPOST("MRP_MO_FREE_TEXT", 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST("MRP_MO_FREE_TEXT", 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "MRP_MO_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/mrp_extrafields.php b/htdocs/admin/mrp_extrafields.php
index cab7232f569..b0bd0e522ab 100644
--- a/htdocs/admin/mrp_extrafields.php
+++ b/htdocs/admin/mrp_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'mrp_mo';
diff --git a/htdocs/admin/multicurrency.php b/htdocs/admin/multicurrency.php
index a7e073f08d2..a447551b04e 100644
--- a/htdocs/admin/multicurrency.php
+++ b/htdocs/admin/multicurrency.php
@@ -38,7 +38,7 @@ if (!$user->admin) {
}
// Parameters
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/admin/notification.php b/htdocs/admin/notification.php
index a32cd0fa1f5..b484e7acea9 100644
--- a/htdocs/admin/notification.php
+++ b/htdocs/admin/notification.php
@@ -95,7 +95,7 @@ if ($action == 'setvalue' && $user->admin)
{
$db->begin();
- $result = dolibarr_set_const($db, "NOTIFICATION_EMAIL_FROM", GETPOST("email_from", "none"), 'chaine', 0, '', $conf->entity);
+ $result = dolibarr_set_const($db, "NOTIFICATION_EMAIL_FROM", GETPOST("email_from", "restricthtml"), 'chaine', 0, '', $conf->entity);
if ($result < 0) $error++;
diff --git a/htdocs/admin/oauth.php b/htdocs/admin/oauth.php
index 85cd9284535..8b0e9516abd 100644
--- a/htdocs/admin/oauth.php
+++ b/htdocs/admin/oauth.php
@@ -40,7 +40,7 @@ $langs->loadLangs(array('admin', 'oauth'));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/admin/oauthlogintokens.php b/htdocs/admin/oauthlogintokens.php
index a2b35c9eceb..0f12da3a02a 100644
--- a/htdocs/admin/oauthlogintokens.php
+++ b/htdocs/admin/oauthlogintokens.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array('admin', 'printing', 'oauth'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$mode = GETPOST('mode', 'alpha');
$value = GETPOST('value', 'alpha');
$varname = GETPOST('varname', 'alpha');
diff --git a/htdocs/admin/order_extrafields.php b/htdocs/admin/order_extrafields.php
index 2c72c55697f..1b2bb0c0cd0 100644
--- a/htdocs/admin/order_extrafields.php
+++ b/htdocs/admin/order_extrafields.php
@@ -45,7 +45,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'commande'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/orderdet_extrafields.php b/htdocs/admin/orderdet_extrafields.php
index 55732a40a51..1f645241646 100644
--- a/htdocs/admin/orderdet_extrafields.php
+++ b/htdocs/admin/orderdet_extrafields.php
@@ -46,7 +46,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'commandedet'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/payment.php b/htdocs/admin/payment.php
index 85d7e140a6d..926c102c25a 100644
--- a/htdocs/admin/payment.php
+++ b/htdocs/admin/payment.php
@@ -32,7 +32,7 @@ $langs->loadLangs(array("admin", "other", "errors", "bills"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -68,7 +68,7 @@ if ($action == 'setmod')
if ($action == 'setparams')
{
- $freetext = GETPOST('FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS", $freetext, 'chaine', 0, '', $conf->entity);
if (!$res > 0) $error++;
diff --git a/htdocs/admin/paymentbybanktransfer.php b/htdocs/admin/paymentbybanktransfer.php
index a19a69c75a5..c549e29443e 100644
--- a/htdocs/admin/paymentbybanktransfer.php
+++ b/htdocs/admin/paymentbybanktransfer.php
@@ -36,7 +36,7 @@ $langs->loadLangs(array("admin", "withdrawals"));
// Security check
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$type = 'paymentorder';
diff --git a/htdocs/admin/pdf.php b/htdocs/admin/pdf.php
index 6fb1cb297dd..95487fc0bc3 100644
--- a/htdocs/admin/pdf.php
+++ b/htdocs/admin/pdf.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array('admin', 'languages', 'other', 'companies', 'products',
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
diff --git a/htdocs/admin/prelevement.php b/htdocs/admin/prelevement.php
index 3419551f627..0429fde6287 100644
--- a/htdocs/admin/prelevement.php
+++ b/htdocs/admin/prelevement.php
@@ -36,7 +36,7 @@ $langs->loadLangs(array("admin", "withdrawals"));
// Security check
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$type = 'paymentorder';
diff --git a/htdocs/admin/propal.php b/htdocs/admin/propal.php
index 4855a164412..a0f9adb86d9 100644
--- a/htdocs/admin/propal.php
+++ b/htdocs/admin/propal.php
@@ -39,7 +39,7 @@ $langs->loadLangs(array("admin", "other", "errors", "propal"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -130,7 +130,7 @@ if ($action == 'updateMask') {
setEventMessages($langs->trans("Error"), null, 'errors');
}
} elseif ($action == 'set_PROPOSAL_FREE_TEXT') {
- $freetext = GETPOST('PROPOSAL_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('PROPOSAL_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "PROPOSAL_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/receiptprinter.php b/htdocs/admin/receiptprinter.php
index 4332c4feab0..9b3563edd63 100644
--- a/htdocs/admin/receiptprinter.php
+++ b/htdocs/admin/receiptprinter.php
@@ -36,7 +36,7 @@ $langs->loadLangs(array("admin", "receiptprinter"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$mode = GETPOST('mode', 'alpha');
$printername = GETPOST('printername', 'alpha');
diff --git a/htdocs/admin/reception_extrafields.php b/htdocs/admin/reception_extrafields.php
index ce5cbcd7179..d9babd5d95b 100644
--- a/htdocs/admin/reception_extrafields.php
+++ b/htdocs/admin/reception_extrafields.php
@@ -50,7 +50,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->trans($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'reception'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/reception_setup.php b/htdocs/admin/reception_setup.php
index 3d0b591af10..4c33ee78ef7 100644
--- a/htdocs/admin/reception_setup.php
+++ b/htdocs/admin/reception_setup.php
@@ -32,7 +32,7 @@ $langs->loadLangs(array("admin", "receptions", 'other'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -76,7 +76,7 @@ if ($action == 'updateMask')
}
} elseif ($action == 'set_param')
{
- $freetext = GETPOST('RECEPTION_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('RECEPTION_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "RECEPTION_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
if ($res <= 0)
{
diff --git a/htdocs/admin/resource.php b/htdocs/admin/resource.php
index 288f338941c..b57e41ddfd4 100644
--- a/htdocs/admin/resource.php
+++ b/htdocs/admin/resource.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array("admin", "resource"));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/admin/resource_extrafields.php b/htdocs/admin/resource_extrafields.php
index 57eaa0d245c..61b0bf900df 100644
--- a/htdocs/admin/resource_extrafields.php
+++ b/htdocs/admin/resource_extrafields.php
@@ -44,7 +44,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'resource'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/security_file.php b/htdocs/admin/security_file.php
index d4d8b0718ae..4b665123e4f 100644
--- a/htdocs/admin/security_file.php
+++ b/htdocs/admin/security_file.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array('users', 'admin', 'other'));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$upload_dir = $conf->admin->dir_temp;
@@ -52,8 +52,8 @@ if (GETPOST('sendit') && !empty($conf->global->MAIN_UPLOAD_DOC))
if ($action == 'updateform')
{
- $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'none'); // Use GETPOST none because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
- $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'none'); // Use GETPOST none because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
+ $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
+ $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
$antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command
$antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params
diff --git a/htdocs/admin/security_other.php b/htdocs/admin/security_other.php
index 2bc477f6e39..686c0ddc21c 100644
--- a/htdocs/admin/security_other.php
+++ b/htdocs/admin/security_other.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array("users", "admin", "other"));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
diff --git a/htdocs/admin/stock.php b/htdocs/admin/stock.php
index 4edff5e93b3..44ae6a82945 100644
--- a/htdocs/admin/stock.php
+++ b/htdocs/admin/stock.php
@@ -36,7 +36,7 @@ $langs->loadLangs(array("admin", "stocks"));
// Securit check
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
diff --git a/htdocs/admin/supplier_invoice.php b/htdocs/admin/supplier_invoice.php
index 59613f6af5b..9b618fa3d31 100644
--- a/htdocs/admin/supplier_invoice.php
+++ b/htdocs/admin/supplier_invoice.php
@@ -42,7 +42,7 @@ accessforbidden();
$type = GETPOST('type', 'alpha');
$value = GETPOST('value', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -167,7 +167,7 @@ if ($action == 'addcat')
if ($action == 'set_SUPPLIER_INVOICE_FREE_TEXT')
{
- $freetext = GETPOST('SUPPLIER_INVOICE_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('SUPPLIER_INVOICE_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "SUPPLIER_INVOICE_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/supplier_order.php b/htdocs/admin/supplier_order.php
index a390e4a4522..c7026ca7327 100644
--- a/htdocs/admin/supplier_order.php
+++ b/htdocs/admin/supplier_order.php
@@ -43,7 +43,7 @@ accessforbidden();
$type = GETPOST('type', 'alpha');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$scandir = GETPOST('scan_dir', 'alpha');
$specimenthirdparty = new Societe($db);
@@ -154,7 +154,7 @@ elseif ($action == 'setdoc')
$fourn->CreateCategory($user, GETPOST('cat', 'alphanohtml'));
} elseif ($action == 'set_SUPPLIER_ORDER_OTHER')
{
- $freetext = GETPOST('SUPPLIER_ORDER_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('SUPPLIER_ORDER_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$doubleapproval = GETPOST('SUPPLIER_ORDER_3_STEPS_TO_BE_APPROVED', 'alpha');
$doubleapproval = price2num($doubleapproval);
diff --git a/htdocs/admin/supplier_payment.php b/htdocs/admin/supplier_payment.php
index 2eea751f8ac..27b3c023fcb 100644
--- a/htdocs/admin/supplier_payment.php
+++ b/htdocs/admin/supplier_payment.php
@@ -33,7 +33,7 @@ $langs->loadLangs(array("admin", "errors", "other", "bills", "orders"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scandir', 'alpha');
diff --git a/htdocs/admin/supplier_proposal.php b/htdocs/admin/supplier_proposal.php
index 5f35f3af310..b0c5c4bff10 100644
--- a/htdocs/admin/supplier_proposal.php
+++ b/htdocs/admin/supplier_proposal.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array("admin", "errors", "other", "supplier_proposal"));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scan_dir', 'alpha');
@@ -123,7 +123,7 @@ if ($action == 'set_SUPPLIER_PROPOSAL_DRAFT_WATERMARK')
if ($action == 'set_SUPPLIER_PROPOSAL_FREE_TEXT')
{
- $freetext = GETPOST('SUPPLIER_PROPOSAL_FREE_TEXT', 'none'); // No alpha here, we want exact string
+ $freetext = GETPOST('SUPPLIER_PROPOSAL_FREE_TEXT', 'restricthtml'); // No alpha here, we want exact string
$res = dolibarr_set_const($db, "SUPPLIER_PROPOSAL_FREE_TEXT", $freetext, 'chaine', 0, '', $conf->entity);
diff --git a/htdocs/admin/supplierinvoice_extrafields.php b/htdocs/admin/supplierinvoice_extrafields.php
index 172f243a22c..50e2fbbbb91 100644
--- a/htdocs/admin/supplierinvoice_extrafields.php
+++ b/htdocs/admin/supplierinvoice_extrafields.php
@@ -45,7 +45,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facture_fourn'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/supplierinvoicedet_extrafields.php b/htdocs/admin/supplierinvoicedet_extrafields.php
index a9fa9c1b09d..15a96009392 100644
--- a/htdocs/admin/supplierinvoicedet_extrafields.php
+++ b/htdocs/admin/supplierinvoicedet_extrafields.php
@@ -47,7 +47,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facture_fourn_det'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/supplierorder_extrafields.php b/htdocs/admin/supplierorder_extrafields.php
index c280e56ac86..17d866d8f94 100644
--- a/htdocs/admin/supplierorder_extrafields.php
+++ b/htdocs/admin/supplierorder_extrafields.php
@@ -45,7 +45,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'commande_fournisseur'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/supplierorderdet_extrafields.php b/htdocs/admin/supplierorderdet_extrafields.php
index 59cc6783db8..1bcfcec05c4 100644
--- a/htdocs/admin/supplierorderdet_extrafields.php
+++ b/htdocs/admin/supplierorderdet_extrafields.php
@@ -46,7 +46,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'commande_fournisseurdet'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/system/about.php b/htdocs/admin/system/about.php
index 615d353bbf1..bbac6bdfe0c 100644
--- a/htdocs/admin/system/about.php
+++ b/htdocs/admin/system/about.php
@@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("help", "members", "other", "admin"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if (!$user->admin) accessforbidden();
diff --git a/htdocs/admin/system/database-tables.php b/htdocs/admin/system/database-tables.php
index c0a52337a25..683fc3c4f3a 100644
--- a/htdocs/admin/system/database-tables.php
+++ b/htdocs/admin/system/database-tables.php
@@ -32,7 +32,7 @@ if (!$user->admin) {
accessforbidden();
}
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if ($action == 'convert')
diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php
index 9288c2e2f1b..55a46e9f347 100644
--- a/htdocs/admin/system/dolibarr.php
+++ b/htdocs/admin/system/dolibarr.php
@@ -32,7 +32,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("install", "other", "admin"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if (!$user->admin)
accessforbidden();
diff --git a/htdocs/admin/system/filecheck.php b/htdocs/admin/system/filecheck.php
index e1f85ca77ce..88cf39b90a1 100644
--- a/htdocs/admin/system/filecheck.php
+++ b/htdocs/admin/system/filecheck.php
@@ -1,5 +1,5 @@
+/* Copyright (C) 2005-2020 Laurent Destailleur
* Copyright (C) 2007 Rodolphe Quiedeville
* Copyright (C) 2007-2012 Regis Houssin
* Copyright (C) 2015-2019 Frederic France
@@ -195,9 +195,9 @@ if (!$error && $xml)
$i++;
$out .= '';
$out .= ''.$i.' '."\n";
- $out .= ''.$constname.' '."\n";
- $out .= ''.$constvalue.' '."\n";
- $out .= ''.$valueforchecksum.' '."\n";
+ $out .= ''.dol_escape_htmltag($constname).' '."\n";
+ $out .= ''.dol_escape_htmltag($constvalue).' '."\n";
+ $out .= ''.dol_escape_htmltag($valueforchecksum).' '."\n";
$out .= " \n";
}
@@ -255,11 +255,11 @@ if (!$error && $xml)
$i++;
$out .= '';
$out .= ''.$i.' '."\n";
- $out .= ''.$file['filename'].' '."\n";
+ $out .= ''.dol_escape_htmltag($file['filename']).' '."\n";
$out .= '';
if (!empty($file['expectedsize'])) $out .= dol_print_size($file['expectedsize']);
$out .= ' '."\n";
- $out .= ''.$file['expectedmd5'].' '."\n";
+ $out .= ''.dol_escape_htmltag($file['expectedmd5']).' '."\n";
$out .= " \n";
}
} else {
@@ -294,9 +294,9 @@ if (!$error && $xml)
$i++;
$out .= '';
$out .= ''.$i.' '."\n";
- $out .= ''.$file['filename'].' '."\n";
- $out .= ''.$file['expectedmd5'].' '."\n";
- $out .= ''.$file['md5'].' '."\n";
+ $out .= ''.dol_escape_htmltag($file['filename']).' '."\n";
+ $out .= ''.dol_escape_htmltag($file['expectedmd5']).' '."\n";
+ $out .= ''.dol_escape_htmltag($file['md5']).' '."\n";
$out .= '';
if ($file['expectedsize']) $out .= dol_print_size($file['expectedsize']);
$out .= ' '."\n";
@@ -346,14 +346,14 @@ if (!$error && $xml)
$i++;
$out .= ' ';
$out .= ''.$i.' '."\n";
- $out .= ''.$file['filename'];
+ $out .= ' '.dol_escape_htmltag($file['filename']);
if (!preg_match('/^win/i', PHP_OS)) {
$htmltext = $langs->trans("YouCanDeleteFileOnServerWith", 'rm '.DOL_DOCUMENT_ROOT.$file['filename']); // The slash is included int file['filename']
$out .= ' '.$form->textwithpicto('', $htmltext, 1, 'help', '', 0, 2, 'helprm'.$i);
}
$out .= ' '."\n";
- $out .= ''.$file['expectedmd5'].' '."\n";
- $out .= ''.$file['md5'].' '."\n";
+ $out .= ''.dol_escape_htmltag($file['expectedmd5']).' '."\n";
+ $out .= ''.dol_escape_htmltag($file['md5']).' '."\n";
$size = dol_filesize(DOL_DOCUMENT_ROOT.'/'.$file['filename']);
$totalsize += $size;
$out .= ''.dol_print_size($size).' '."\n";
diff --git a/htdocs/admin/taxes.php b/htdocs/admin/taxes.php
index 687b43a6918..51a089336c6 100644
--- a/htdocs/admin/taxes.php
+++ b/htdocs/admin/taxes.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array('admin', 'objects', 'companies', 'products'));
if (!$user->admin) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
diff --git a/htdocs/admin/ticket.php b/htdocs/admin/ticket.php
index 974f8874096..4dd8a6fa5c1 100644
--- a/htdocs/admin/ticket.php
+++ b/htdocs/admin/ticket.php
@@ -37,7 +37,7 @@ if (!$user->admin) {
// Parameters
$value = GETPOST('value', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scandir', 'alpha');
$type = 'ticket';
diff --git a/htdocs/admin/ticket_extrafields.php b/htdocs/admin/ticket_extrafields.php
index a01996b31ac..91e5df44180 100644
--- a/htdocs/admin/ticket_extrafields.php
+++ b/htdocs/admin/ticket_extrafields.php
@@ -39,7 +39,7 @@ foreach ($tmptype2label as $key => $val) {
$type2label[$key] = $langs->trans($val);
}
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'ticket'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/admin/ticket_public.php b/htdocs/admin/ticket_public.php
index 72427de3ab0..02e6e6916ee 100644
--- a/htdocs/admin/ticket_public.php
+++ b/htdocs/admin/ticket_public.php
@@ -37,7 +37,7 @@ if (!$user->admin) {
// Parameters
$value = GETPOST('value', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$label = GETPOST('label', 'alpha');
$scandir = GETPOST('scandir', 'alpha');
$type = 'ticket';
diff --git a/htdocs/admin/tools/dolibarr_export.php b/htdocs/admin/tools/dolibarr_export.php
index b7d69247763..b8e6dc8c15e 100644
--- a/htdocs/admin/tools/dolibarr_export.php
+++ b/htdocs/admin/tools/dolibarr_export.php
@@ -29,10 +29,10 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
$langs->load("admin");
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (!$sortorder) $sortorder = "DESC";
if (!$sortfield) $sortfield = "date";
diff --git a/htdocs/admin/tools/export.php b/htdocs/admin/tools/export.php
index 408d82404dc..3614e412318 100644
--- a/htdocs/admin/tools/export.php
+++ b/htdocs/admin/tools/export.php
@@ -30,7 +30,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
$langs->load("admin");
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$what = GETPOST('what', 'alpha');
$export_type = GETPOST('export_type', 'alpha');
$file = GETPOST('filename_template', 'alpha');
@@ -38,7 +38,7 @@ $file = GETPOST('filename_template', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/admin/tools/export_files.php b/htdocs/admin/tools/export_files.php
index e8b60eba5fb..45b02716524 100644
--- a/htdocs/admin/tools/export_files.php
+++ b/htdocs/admin/tools/export_files.php
@@ -30,7 +30,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
$langs->load("admin");
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$what = GETPOST('what', 'alpha');
$export_type = GETPOST('export_type', 'alpha');
$file = GETPOST('zipfilename_template', 'alpha');
@@ -40,7 +40,7 @@ $file = dol_sanitizeFileName($file);
$file = preg_replace('/(\.zip|\.tar|\.tgz|\.gz|\.tar\.gz|\.bz2)$/i', '', $file);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (!$sortorder) $sortorder = "DESC";
if (!$sortfield) $sortfield = "date";
diff --git a/htdocs/admin/tools/listevents.php b/htdocs/admin/tools/listevents.php
index e9d06885dfd..af55fcd1f16 100644
--- a/htdocs/admin/tools/listevents.php
+++ b/htdocs/admin/tools/listevents.php
@@ -1,8 +1,8 @@
+/* Copyright (C) 2004-2020 Laurent Destailleur
* Copyright (C) 2005-2012 Regis Houssin
* Copyright (C) 2015 Bahfir Abbes
- * Copyright (C) 2018 Frédéric France
+ * Copyright (C) 2018 Frédéric France
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
@@ -47,7 +47,7 @@ $langs->loadLangs(array("companies", "admin", "users", "other"));
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
@@ -60,8 +60,8 @@ $search_code = GETPOST("search_code", "alpha");
$search_ip = GETPOST("search_ip", "alpha");
$search_user = GETPOST("search_user", "alpha");
$search_desc = GETPOST("search_desc", "alpha");
-$search_ua = GETPOST("search_ua", "none");
-$search_prefix_session = GETPOST("search_prefix_session", "none");
+$search_ua = GETPOST("search_ua", "restricthtml");
+$search_prefix_session = GETPOST("search_prefix_session", "restricthtml");
if (GETPOST("date_startmonth") == '' || GETPOST("date_startmonth") > 0) $date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"));
else $date_start = -1;
diff --git a/htdocs/admin/tools/listsessions.php b/htdocs/admin/tools/listsessions.php
index 07f9f1ef47c..aedc41e0b23 100644
--- a/htdocs/admin/tools/listsessions.php
+++ b/htdocs/admin/tools/listsessions.php
@@ -31,7 +31,7 @@ $langs->loadLangs(array("companies", "install", "users", "other"));
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
diff --git a/htdocs/admin/tools/purge.php b/htdocs/admin/tools/purge.php
index 9898e290ddc..c41b43b3b48 100644
--- a/htdocs/admin/tools/purge.php
+++ b/htdocs/admin/tools/purge.php
@@ -29,7 +29,7 @@ $langs->load("admin");
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$choice = GETPOST('choice', 'aZ09');
diff --git a/htdocs/admin/tools/update.php b/htdocs/admin/tools/update.php
index 67f07a4eb24..27b53e8266e 100644
--- a/htdocs/admin/tools/update.php
+++ b/htdocs/admin/tools/update.php
@@ -30,7 +30,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("admin", "other"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if (!$user->admin) accessforbidden();
diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php
index 309d15485eb..9259ac420b7 100644
--- a/htdocs/admin/translation.php
+++ b/htdocs/admin/translation.php
@@ -33,11 +33,11 @@ $langs->loadLangs(array("companies", "products", "admin", "sms", "other", "error
if (!$user->admin) accessforbidden();
$id = GETPOST('rowid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$langcode = GETPOST('langcode', 'alphanohtml');
$transkey = GETPOST('transkey', 'alphanohtml');
-$transvalue = GETPOST('transvalue', 'none');
+$transvalue = GETPOST('transvalue', 'restricthtml');
$mode = GETPOST('mode', 'aZ09') ?GETPOST('mode', 'aZ09') : 'searchkey';
diff --git a/htdocs/admin/user.php b/htdocs/admin/user.php
index f866b418131..25822cd380b 100644
--- a/htdocs/admin/user.php
+++ b/htdocs/admin/user.php
@@ -38,7 +38,7 @@ if (!$user->admin) accessforbidden();
$extrafields = new ExtraFields($db);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
$value = GETPOST('value', 'alpha');
diff --git a/htdocs/admin/usergroup.php b/htdocs/admin/usergroup.php
index 490c79a3363..d6b66b6fd22 100644
--- a/htdocs/admin/usergroup.php
+++ b/htdocs/admin/usergroup.php
@@ -38,7 +38,7 @@ if (!$user->admin) accessforbidden();
$extrafields = new ExtraFields($db);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$type = 'group';
diff --git a/htdocs/admin/website.php b/htdocs/admin/website.php
index 4254408ed90..7c098aa1c4b 100644
--- a/htdocs/admin/website.php
+++ b/htdocs/admin/website.php
@@ -52,7 +52,7 @@ $actl[1] = img_picto($langs->trans("Activated"), 'switch_on');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/admin/website_options.php b/htdocs/admin/website_options.php
index 6f0cffa41c8..2bbe3e84638 100644
--- a/htdocs/admin/website_options.php
+++ b/htdocs/admin/website_options.php
@@ -47,7 +47,7 @@ $status = 1;
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/admin/workflow.php b/htdocs/admin/workflow.php
index 671bacee080..dddcaf91c81 100644
--- a/htdocs/admin/workflow.php
+++ b/htdocs/admin/workflow.php
@@ -33,7 +33,7 @@ if (!$user->admin) accessforbidden();
// Load translation files required by the page
$langs->loadLangs(array("admin", "workflow", "propal", "workflow", "orders", "supplier_proposal", "receptions", "errors"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
/*
diff --git a/htdocs/asset/admin/assets_extrafields.php b/htdocs/asset/admin/assets_extrafields.php
index be36482c295..0bdbff93569 100644
--- a/htdocs/asset/admin/assets_extrafields.php
+++ b/htdocs/asset/admin/assets_extrafields.php
@@ -37,7 +37,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'don'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/asset/admin/assets_type_extrafields.php b/htdocs/asset/admin/assets_type_extrafields.php
index 2f10938d356..ba42a3374dc 100644
--- a/htdocs/asset/admin/assets_type_extrafields.php
+++ b/htdocs/asset/admin/assets_type_extrafields.php
@@ -36,7 +36,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'adherent_type'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/asset/admin/setup.php b/htdocs/asset/admin/setup.php
index c1afe7ba472..64e2bc2b5ad 100644
--- a/htdocs/asset/admin/setup.php
+++ b/htdocs/asset/admin/setup.php
@@ -35,7 +35,7 @@ $langs->loadLangs(array("admin", "assets"));
if (!$user->admin) accessforbidden();
// Parameters
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
$arrayofparameters = array('FIXEDASSETS_MYPARAM1'=>array('css'=>'minwidth200'), 'FIXEDASSETS_MYPARAM2'=>array('css'=>'minwidth500'));
diff --git a/htdocs/asset/info.php b/htdocs/asset/info.php
index 900bbc61bf2..2654ebc2d81 100644
--- a/htdocs/asset/info.php
+++ b/htdocs/asset/info.php
@@ -31,7 +31,7 @@ $langs->loadLangs(array("asset"));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
if ($user->socid) $socid = $user->socid;
diff --git a/htdocs/asset/list.php b/htdocs/asset/list.php
index ab31c6c9831..224caea2e58 100644
--- a/htdocs/asset/list.php
+++ b/htdocs/asset/list.php
@@ -48,7 +48,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/asset/note.php b/htdocs/asset/note.php
index 7b92e1dab92..8df2a7a5452 100644
--- a/htdocs/asset/note.php
+++ b/htdocs/asset/note.php
@@ -32,7 +32,7 @@ $langs->loadLangs(array("asset", "companies"));
// Get parameters
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/asset/type.php b/htdocs/asset/type.php
index eebc85fc099..01418fde201 100644
--- a/htdocs/asset/type.php
+++ b/htdocs/asset/type.php
@@ -34,7 +34,7 @@ if (!empty($conf->accounting->enabled)) require_once DOL_DOCUMENT_ROOT.'/account
$langs->load("assets");
$rowid = GETPOST('rowid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/barcode/printsheet.php b/htdocs/barcode/printsheet.php
index 1ac908f361a..dabd05bf745 100644
--- a/htdocs/barcode/printsheet.php
+++ b/htdocs/barcode/printsheet.php
@@ -36,10 +36,10 @@ $now = dol_now();
$year = dol_print_date($now, '%Y');
$month = dol_print_date($now, '%m');
$day = dol_print_date($now, '%d');
-$forbarcode = GETPOST('forbarcode');
-$fk_barcode_type = GETPOST('fk_barcode_type');
-$mode = GETPOST('mode');
-$modellabel = GETPOST("modellabel"); // Doc template to use
+$forbarcode = GETPOST('forbarcode', 'alphanohtml');
+$fk_barcode_type = GETPOST('fk_barcode_type', 'int');
+$mode = GETPOST('mode', 'aZ09');
+$modellabel = GETPOST("modellabel", 'aZ09'); // Doc template to use
$numberofsticker = GETPOST('numberofsticker', 'int');
$mesg = '';
@@ -57,8 +57,8 @@ $thirdpartytmp = new Societe($db);
if (GETPOST('submitproduct') && GETPOST('submitproduct'))
{
$action = ''; // We reset because we don't want to build doc
- if (GETPOST('productid') > 0) {
- $result = $producttmp->fetch(GETPOST('productid'));
+ if (GETPOST('productid', 'int') > 0) {
+ $result = $producttmp->fetch(GETPOST('productid', 'int'));
if ($result < 0) {
setEventMessage($producttmp->error, 'errors');
}
@@ -76,9 +76,9 @@ if (GETPOST('submitproduct') && GETPOST('submitproduct'))
if (GETPOST('submitthirdparty') && GETPOST('submitthirdparty'))
{
$action = ''; // We reset because we don't want to build doc
- if (GETPOST('socid') > 0)
+ if (GETPOST('socid', 'int') > 0)
{
- $thirdpartytmp->fetch(GETPOST('socid'));
+ $thirdpartytmp->fetch(GETPOST('socid', 'int'));
$forbarcode = $thirdpartytmp->barcode;
$fk_barcode_type = $thirdpartytmp->barcode_type_code;
@@ -381,7 +381,7 @@ if (!empty($user->rights->produit->lire) || !empty($user->rights->service->lire)
print '';
- $form->select_produits(GETPOST('productid'), 'productid', '', '', 0, -1, 2, '', 0, array(), 0, '1', 0, 'minwidth400imp', 1);
+ $form->select_produits(GETPOST('productid', 'int'), 'productid', '', '', 0, -1, 2, '', 0, array(), 0, '1', 0, 'minwidth400imp', 1);
print '
';
}
@@ -391,7 +391,7 @@ if (!empty($user->rights->societe->lire))
print '';
- print $form->select_company(GETPOST('socid'), 'socid', '', 'SelectThirdParty', 0, 0, array(), 0, 'minwidth300');
+ print $form->select_company(GETPOST('socid', 'int'), 'socid', '', 'SelectThirdParty', 0, 0, array(), 0, 'minwidth300');
print '
';
}
diff --git a/htdocs/blockedlog/admin/blockedlog.php b/htdocs/blockedlog/admin/blockedlog.php
index 1b6ff1fa021..051f8bb049a 100644
--- a/htdocs/blockedlog/admin/blockedlog.php
+++ b/htdocs/blockedlog/admin/blockedlog.php
@@ -32,7 +32,7 @@ $langs->loadLangs(array("admin", "other", "blockedlog"));
if (!$user->admin || empty($conf->blockedlog->enabled)) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/blockedlog/admin/blockedlog_list.php b/htdocs/blockedlog/admin/blockedlog_list.php
index ab36caedba4..818c84a8b5e 100644
--- a/htdocs/blockedlog/admin/blockedlog_list.php
+++ b/htdocs/blockedlog/admin/blockedlog_list.php
@@ -35,7 +35,7 @@ $langs->loadLangs(array("admin", "other", "blockedlog", "bills"));
if ((!$user->admin && !$user->rights->blockedlog->read) || empty($conf->blockedlog->enabled)) accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'blockedloglist'; // To manage different context of search
$backtopage = GETPOST('backtopage', 'alpha'); // Go back to a dedicated page
$optioncss = GETPOST('optioncss', 'aZ'); // Option for the css output (always '' except when 'print')
@@ -57,7 +57,7 @@ if (($search_start == -1 || empty($search_start)) && !GETPOSTISSET('search_start
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/blockedlog/ajax/block-add.php b/htdocs/blockedlog/ajax/block-add.php
index 5aa344c0237..1102438f5b5 100644
--- a/htdocs/blockedlog/ajax/block-add.php
+++ b/htdocs/blockedlog/ajax/block-add.php
@@ -34,7 +34,7 @@ $res = require '../../main.inc.php';
$id = GETPOST('id', 'int');
$element = GETPOST('element', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if ($element === 'facture') {
require_once DOL_DOCUMENT_ROOT.'/blockedlog/class/blockedlog.class.php';
diff --git a/htdocs/bom/bom_agenda.php b/htdocs/bom/bom_agenda.php
index 43f1604e08c..d8361d30258 100644
--- a/htdocs/bom/bom_agenda.php
+++ b/htdocs/bom/bom_agenda.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array("mrp", "other"));
// Get parameters
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/bom/bom_list.php b/htdocs/bom/bom_list.php
index 6092f11aea5..5f1728ef055 100644
--- a/htdocs/bom/bom_list.php
+++ b/htdocs/bom/bom_list.php
@@ -46,7 +46,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/bom/bom_note.php b/htdocs/bom/bom_note.php
index dce9bc82b06..df1693e84b0 100644
--- a/htdocs/bom/bom_note.php
+++ b/htdocs/bom/bom_note.php
@@ -33,7 +33,7 @@ $langs->loadLangs(array("mrp", "companies"));
// Get parameters
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
diff --git a/htdocs/bookmarks/admin/bookmark.php b/htdocs/bookmarks/admin/bookmark.php
index 2d8501130dc..9aa1989fa2e 100644
--- a/htdocs/bookmarks/admin/bookmark.php
+++ b/htdocs/bookmarks/admin/bookmark.php
@@ -31,7 +31,7 @@ $langs->load("admin");
if (!$user->admin)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
if ($action == 'setvalue')
{
diff --git a/htdocs/bookmarks/list.php b/htdocs/bookmarks/list.php
index a4f0939c054..3ea33b329ff 100644
--- a/htdocs/bookmarks/list.php
+++ b/htdocs/bookmarks/list.php
@@ -27,7 +27,7 @@ require_once DOL_DOCUMENT_ROOT.'/bookmarks/class/bookmark.class.php';
// Load translation files required by the page
$langs->loadLangs(array('bookmarks', 'admin'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
@@ -43,7 +43,7 @@ $optioncss = GETPOST('optioncss', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/cashdesk/facturation_verif.php b/htdocs/cashdesk/facturation_verif.php
index c62e31b1e3f..16b4bfec017 100644
--- a/htdocs/cashdesk/facturation_verif.php
+++ b/htdocs/cashdesk/facturation_verif.php
@@ -29,7 +29,7 @@ require_once DOL_DOCUMENT_ROOT.'/cashdesk/class/Facturation.class.php';
require_once DOL_DOCUMENT_ROOT.'/societe/class/societe.class.php';
require_once DOL_DOCUMENT_ROOT.'/product/class/product.class.php';
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$obj_facturation = unserialize($_SESSION['serObjFacturation']);
unset($_SESSION['serObjFacturation']);
diff --git a/htdocs/categories/admin/categorie_extrafields.php b/htdocs/categories/admin/categorie_extrafields.php
index bd285e5efaf..72151abdcdb 100644
--- a/htdocs/categories/admin/categorie_extrafields.php
+++ b/htdocs/categories/admin/categorie_extrafields.php
@@ -39,7 +39,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'categorie'; //Must be the $element of the class that manage extrafield
diff --git a/htdocs/categories/traduction.php b/htdocs/categories/traduction.php
index a8f3510c31b..cf3db3444c7 100644
--- a/htdocs/categories/traduction.php
+++ b/htdocs/categories/traduction.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array('categories', 'languages'));
$id = GETPOST('id', 'int');
$label = GETPOST('label', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$type = GETPOST('type', 'aZ09');
@@ -85,7 +85,7 @@ $cancel != $langs->trans("Cancel") &&
// check parameters
$forcelangprod = GETPOST('forcelangprod', 'alpha');
$libelle = GETPOST('libelle', 'alpha');
- $desc = GETPOST('desc', 'none');
+ $desc = GETPOST('desc', 'restricthtml');
if (empty($forcelangprod)) {
$error++;
@@ -338,7 +338,7 @@ if ($action == 'add' && ($user->rights->produit->creer || $user->rights->service
print ''.$langs->trans('Label').' ';
print ''.$langs->trans('Description').' ';
- $doleditor = new DolEditor('desc', GETPOST('desc', 'none'), '', 160, 'dolibarr_notes', '', false, true, $conf->global->FCKEDITOR_ENABLE_PRODUCTDESC, ROWS_3, '90%');
+ $doleditor = new DolEditor('desc', GETPOST('desc', 'restricthtml'), '', 160, 'dolibarr_notes', '', false, true, $conf->global->FCKEDITOR_ENABLE_PRODUCTDESC, ROWS_3, '90%');
$doleditor->Create();
print ' '.$langs->trans("Description").' ';
require_once DOL_DOCUMENT_ROOT.'/core/class/doleditor.class.php';
- $doleditor = new DolEditor('note', (GETPOSTISSET('note') ? GETPOST('note', 'none') : $object->note_private), '', 120, 'dolibarr_notes', 'In', true, true, $conf->fckeditor->enabled, ROWS_4, '90%');
+ $doleditor = new DolEditor('note', (GETPOSTISSET('note') ? GETPOST('note', 'restricthtml') : $object->note_private), '', 120, 'dolibarr_notes', 'In', true, true, $conf->fckeditor->enabled, ROWS_4, '90%');
$doleditor->Create();
print '
- * Copyright (C) 2005-2012 Regis Houssin
- * Copyright (C) 2015 Jean-François Ferry
- * Copyright (C) 2019 Nicolas ZABOURI
- * Copyright (C) 2020 Pierre Ardoin
- * Copyright (C) 2020 Tobias Sekan
+/* Copyright (C) 2001-2005 Rodolphe Quiedeville
+ * Copyright (C) 2004-2015 Laurent Destailleur
+ * Copyright (C) 2005-2012 Regis Houssin
+ * Copyright (C) 2015 Jean-François Ferry
+ * Copyright (C) 2019 Nicolas ZABOURI
+ * Copyright (C) 2020 Pierre Ardoin
+ * Copyright (C) 2020 Tobias Sekan
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -22,33 +22,33 @@
*/
/**
- * \file htdocs/comm/index.php
- * \ingroup commercial
- * \brief Home page of commercial area
+ * \file htdocs/comm/index.php
+ * \ingroup commercial
+ * \brief Home page of commercial area
*/
require '../main.inc.php';
-require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
-require_once DOL_DOCUMENT_ROOT.'/societe/class/client.class.php';
-require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
-require_once DOL_DOCUMENT_ROOT.'/core/lib/agenda.lib.php';
-if (!empty($conf->contrat->enabled)) require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
-if (!empty($conf->propal->enabled)) require_once DOL_DOCUMENT_ROOT.'/comm/propal/class/propal.class.php';
-if (!empty($conf->supplier_proposal->enabled)) require_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php';
-if (!empty($conf->commande->enabled)) require_once DOL_DOCUMENT_ROOT.'/commande/class/commande.class.php';
-if (!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) || ! empty($conf->supplier_order->enabled)) require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php';
if (!$user->rights->societe->lire) accessforbidden();
-$hookmanager = new HookManager($db);
+require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
+require_once DOL_DOCUMENT_ROOT.'/core/lib/agenda.lib.php';
+require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
+require_once DOL_DOCUMENT_ROOT.'/comm/propal/class/propal.class.php';
+require_once DOL_DOCUMENT_ROOT.'/commande/class/commande.class.php';
+require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
+require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php';
+require_once DOL_DOCUMENT_ROOT.'/societe/class/client.class.php';
+require_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php';
// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
+$hookmanager = new HookManager($db);
$hookmanager->initHooks(array('commercialindex'));
// Load translation files required by the page
-$langs->loadLangs(array("commercial", "propal"));
+$langs->loadLangs(array("boxes", "commercial", "contracts", "orders", "propal", "supplier_proposal"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$bid = GETPOST('bid', 'int');
// Securite acces client
@@ -84,7 +84,8 @@ print load_fiche_titre($langs->trans("CommercialArea"), '', 'commercial');
print '';
-if (!empty($conf->global->MAIN_SEARCH_FORM_ON_HOME_AREAS)) { // This is useless due to the global search combo
+// This is useless due to the global search combo
+if (!empty($conf->global->MAIN_SEARCH_FORM_ON_HOME_AREAS)) {
// Search proposal
if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
$listofsearchfields['search_proposal'] = array('text'=>'Proposal');
@@ -136,19 +137,14 @@ if (!empty($conf->global->MAIN_SEARCH_FORM_ON_HOME_AREAS)) { // This is useless
* Draft customer proposals
*/
if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
- $langs->load("propal");
-
- $sql = "SELECT p.rowid, p.ref, p.ref_client, p.total_ht, p.tva as total_tva, p.total as total_ttc, s.rowid as socid, s.nom as name, s.client, s.canvas";
- $sql .= ", s.code_client";
- $sql .= ", s.email";
- $sql .= ", s.entity";
- $sql .= ", s.code_compta";
+ $sql = "SELECT p.rowid, p.ref, p.ref_client, p.total_ht, p.tva as total_tva, p.total as total_ttc";
+ $sql .= ", s.rowid as socid, s.nom as name, s.client, s.canvas, s.code_client, s.email, s.entity, s.code_compta";
$sql .= " FROM ".MAIN_DB_PREFIX."propal as p";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE p.fk_statut = 0";
+ $sql .= " WHERE p.entity IN (".getEntity($propalstatic->element).")";
$sql .= " AND p.fk_soc = s.rowid";
- $sql .= " AND p.entity IN (".getEntity('propal').")";
+ $sql .= " AND p.fk_statut = ".Propal::STATUS_DRAFT;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
if ($socid) $sql .= " AND s.rowid = ".$socid;
@@ -157,7 +153,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
$total = 0;
$num = $db->num_rows($resql);
$nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- startSimpleTable("ProposalsDraft", "comm/propal/list.php", "search_status=0", 2, $num);
+ startSimpleTable("ProposalsDraft", "comm/propal/list.php", "search_status=".Propal::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
@@ -185,11 +181,11 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
print '
';
print ''.$propalstatic->getNomUrl(1).' ';
print ''.$companystatic->getNomUrl(1, 'customer', 16).' ';
- print ''.price($obj->total_ht).' ';
+ print ''.price((!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc)).' ';
print ' ';
$i++;
- $total += $obj->total_ht;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -206,28 +202,23 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
* Draft supplier proposals
*/
if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposal->lire) {
- $langs->load("supplier_proposal");
-
- $sql = "SELECT p.rowid, p.ref, p.total_ht, p.tva as total_tva, p.total as total_ttc, s.rowid as socid, s.nom as name, s.client, s.canvas";
- $sql .= ", s.code_client";
- $sql .= ", s.code_fournisseur";
- $sql .= ", s.entity";
- $sql .= ", s.email";
+ $sql = "SELECT p.rowid, p.ref, p.total_ht, p.tva as total_tva, p.total as total_ttc";
+ $sql .= ", s.rowid as socid, s.nom as name, s.client, s.canvas, s.code_client, s.code_fournisseur, s.entity, s.email";
$sql .= " FROM ".MAIN_DB_PREFIX."supplier_proposal as p";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE p.fk_statut = 0";
+ $sql .= " WHERE p.entity IN (".getEntity($supplierproposalstatic->element).")";
+ $sql .= " AND p.fk_statut = ".SupplierProposal::STATUS_DRAFT;
$sql .= " AND p.fk_soc = s.rowid";
- $sql .= " AND p.entity IN (".getEntity('supplier_proposal').")";
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
- if ($socid) $sql .= " AND s.rowid = ".$socid;
+ if ($socid) $sql .= " AND s.rowid = ".$socid;
$resql = $db->query($sql);
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
$nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- startSimpleTable("SupplierProposalsDraft", "supplier_proposal/list.php", "search_status=0", 2, $num);
+ startSimpleTable("SupplierProposalsDraft", "supplier_proposal/list.php", "search_status=".SupplierProposal::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
@@ -251,13 +242,13 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa
$companystatic->email = $obj->email;
print '';
- print ''.$supplierproposalstatic->getNomUrl(1).' ';
+ print ''.$supplierproposalstatic->getNomUrl(1).' ';
print ''.$companystatic->getNomUrl(1, 'supplier', 16).' ';
- print ''.price($obj->total_ht).' ';
+ print ''.price(!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc).' ';
print ' ';
$i++;
- $total += $obj->total_ht;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -274,28 +265,23 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa
* Draft customer orders
*/
if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
- $langs->load("orders");
-
- $sql = "SELECT c.rowid, c.ref, c.ref_client, c.total_ht, c.tva as total_tva, c.total_ttc, s.rowid as socid, s.nom as name, s.client, s.canvas";
- $sql .= ", s.code_client";
- $sql .= ", s.email";
- $sql .= ", s.entity";
- $sql .= ", s.code_compta";
+ $sql = "SELECT c.rowid, c.ref, c.ref_client, c.total_ht, c.tva as total_tva, c.total_ttc";
+ $sql .= ", s.rowid as socid, s.nom as name, s.client, s.canvas, s.code_client, s.email, s.entity, s.code_compta";
$sql .= " FROM ".MAIN_DB_PREFIX."commande as c";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE c.fk_soc = s.rowid";
- $sql .= " AND c.fk_statut = 0";
- $sql .= " AND c.entity IN (".getEntity('commande').")";
+ $sql .= " WHERE c.entity IN (".getEntity($orderstatic->element).")";
+ $sql .= " AND c.fk_statut = ".Commande::STATUS_DRAFT;
+ $sql .= " AND c.fk_soc = s.rowid";
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
- if ($socid) $sql .= " AND c.fk_soc = ".$socid;
+ if ($socid) $sql .= " AND c.fk_soc = ".$socid;
$resql = $db->query($sql);
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
$nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- startSimpleTable("DraftOrders", "commande/list.php", "search_status=0", 2, $num);
+ startSimpleTable("DraftOrders", "commande/list.php", "search_status=".Commande::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
@@ -326,7 +312,7 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
print ' ';
$i++;
- $total += $obj->total_ttc;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -343,28 +329,23 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
* Draft suppliers orders
*/
if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) || !empty($conf->supplier_order->enabled)) && $user->rights->fournisseur->commande->lire) {
- $langs->load("orders");
-
- $sql = "SELECT cf.rowid, cf.ref, cf.ref_supplier, cf.total_ttc, s.rowid as socid, s.nom as name, s.client, s.canvas";
- $sql .= ", s.code_client";
- $sql .= ", s.code_fournisseur";
- $sql .= ", s.entity";
- $sql .= ", s.email";
+ $sql = "SELECT cf.rowid, cf.ref, cf.ref_supplier, cf.total_ttc";
+ $sql .= ", s.rowid as socid, s.nom as name, s.client, s.canvas, s.code_client, s.code_fournisseur, s.entity, s.email";
$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur as cf";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE cf.fk_soc = s.rowid";
- $sql .= " AND cf.fk_statut = 0";
- $sql .= " AND cf.entity IN (".getEntity('supplier_order').")";
+ $sql .= " WHERE cf.entity IN (".getEntity($supplierorderstatic->element).")";
+ $sql .= " AND cf.fk_statut = ".CommandeFournisseur::STATUS_DRAFT;
+ $sql .= " AND cf.fk_soc = s.rowid";
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
- if ($socid) $sql .= " AND cf.fk_soc = ".$socid;
+ if ($socid) $sql .= " AND cf.fk_soc = ".$socid;
$resql = $db->query($sql);
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
$nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- startSimpleTable("DraftSuppliersOrders", "fourn/commande/list.php", "search_status=0", 2, $num);
+ startSimpleTable("DraftSuppliersOrders", "fourn/commande/list.php", "search_status=".CommandeFournisseur::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
@@ -395,7 +376,7 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU
print '';
$i++;
- $total += $obj->total_ttc;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -407,27 +388,20 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU
}
}
-print '';
-
-$max = 3;
+print '
';
+print '
';
/*
* Last modified customers or prospects
*/
if (!empty($conf->societe->enabled) && $user->rights->societe->lire) {
- $langs->load("boxes");
-
- $sql = "SELECT s.rowid, s.nom as name, s.client, s.datec, s.tms, s.canvas";
- $sql .= ", s.code_client";
- $sql .= ", s.code_compta";
- $sql .= ", s.entity";
- $sql .= ", s.email";
+ $sql = "SELECT s.rowid, s.nom as name, s.client, s.datec, s.tms, s.canvas, s.code_client, s.code_compta, s.entity, s.email";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE s.client IN (1, 2, 3)";
- $sql .= " AND s.entity IN (".getEntity($companystatic->element).")";
+ $sql .= " WHERE s.entity IN (".getEntity($companystatic->element).")";
+ $sql .= " AND s.client IN (".Societe::CUSTOMER.", ".Societe::PROSPECT.", ".Societe::CUSTOMER_AND_PROSPECT.")";
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
- if ($socid) $sql .= " AND s.rowid = $socid";
+ if ($socid) $sql .= " AND s.rowid = $socid";
$sql .= " ORDER BY s.tms DESC";
$sql .= $db->plimit($max, 0);
@@ -485,18 +459,13 @@ if (!empty($conf->societe->enabled) && $user->rights->societe->lire) {
* Last suppliers
*/
if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) || !empty($conf->supplier_order->enabled) || !empty($conf->supplier_invoice->enabled)) && $user->rights->societe->lire) {
- $langs->load("boxes");
-
- $sql = "SELECT s.nom as name, s.rowid, s.datec as dc, s.canvas, s.tms as dm";
- $sql .= ", s.code_fournisseur";
- $sql .= ", s.entity";
- $sql .= ", s.email";
+ $sql = "SELECT s.nom as name, s.rowid, s.datec as dc, s.canvas, s.tms as dm, s.code_fournisseur, s.entity, s.email";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$user->socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE s.fournisseur = 1";
- $sql .= " AND s.entity IN (".getEntity($companystatic->element).")";
+ $sql .= " WHERE s.entity IN (".getEntity($companystatic->element).")";
+ $sql .= " AND s.fournisseur = ".Societe::SUPPLIER;
if (!$user->rights->societe->client->voir && !$user->socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
- if ($socid) $sql .= " AND s.rowid = ".$socid;
+ if ($socid) $sql .= " AND s.rowid = ".$socid;
$sql .= " ORDER BY s.datec DESC";
$sql .= $db->plimit($max, 0);
@@ -556,21 +525,18 @@ if ($user->rights->agenda->myactions->read) {
* Latest contracts
*/
if (!empty($conf->contrat->enabled) && $user->rights->contrat->lire && 0) { // TODO A REFAIRE DEPUIS NOUVEAU CONTRAT
- $langs->load("contracts");
+ $staticcontrat = new Contrat($db);
- $sql = "SELECT s.nom as name, s.rowid, s.canvas, ";
- $sql .= ", s.code_client";
- $sql .= ", s.entity";
- $sql .= ", s.email";
+ $sql = "SELECT s.nom as name, s.rowid, s.canvas, s.code_client, s.entity, s.email";
$sql .= ", c.statut, c.rowid as contratid, p.ref, c.fin_validite as datefin, c.date_cloture as dateclo";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
$sql .= ", ".MAIN_DB_PREFIX."contrat as c";
$sql .= ", ".MAIN_DB_PREFIX."product as p";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE c.fk_soc = s.rowid";
- $sql .= " AND c.entity IN (".getEntity('contract').")";
+ $sql .= " WHERE c.entity IN (".getEntity($staticcontrat->element).")";
+ $sql .= " AND c.fk_soc = s.rowid";
$sql .= " AND c.fk_product = p.rowid";
- if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
+ if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
if ($socid) $sql .= " AND s.rowid = ".$socid;
$sql .= " ORDER BY c.tms DESC";
$sql .= $db->plimit(5, 0);
@@ -582,7 +548,6 @@ if (!empty($conf->contrat->enabled) && $user->rights->contrat->lire && 0) { // T
if ($num > 0) {
$i = 0;
- $staticcontrat = new Contrat($db);
while ($i < $num) {
$obj = $db->fetch_object($resql);
@@ -615,21 +580,17 @@ if (!empty($conf->contrat->enabled) && $user->rights->contrat->lire && 0) { // T
/*
- * Opened proposals
+ * Opened (validated) proposals
*/
if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
- $langs->load("propal");
-
- $sql = "SELECT s.nom as name, s.rowid, s.code_client";
- $sql .= ", s.entity";
- $sql .= ", s.email";
- $sql .= ", p.rowid as propalid, p.entity, p.total as total_ttc, p.total_ht, p.tva as total_tva, p.ref, p.ref_client, p.fk_statut, p.datep as dp, p.fin_validite as dfv";
- $sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
- $sql .= ", ".MAIN_DB_PREFIX."propal as p";
+ $sql = "SELECT p.rowid as propalid, p.entity, p.total as total_ttc, p.total_ht, p.tva as total_tva, p.ref, p.ref_client, p.fk_statut, p.datep as dp, p.fin_validite as dfv";
+ $sql .= ", s.nom as name, s.rowid, s.code_client, s.entity, s.email";
+ $sql .= " FROM ".MAIN_DB_PREFIX."propal as p";
+ $sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE p.fk_soc = s.rowid";
- $sql .= " AND p.entity IN (".getEntity('propal').")";
- $sql .= " AND p.fk_statut = 1";
+ $sql .= " WHERE p.entity IN (".getEntity($propalstatic->element).")";
+ $sql .= " AND p.fk_soc = s.rowid";
+ $sql .= " AND p.fk_statut = ".Propal::STATUS_VALIDATED;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
if ($socid) $sql .= " AND s.rowid = ".$socid;
$sql .= " ORDER BY p.rowid DESC";
@@ -663,24 +624,21 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
$companystatic->entity = $obj->entity;
$companystatic->email = $obj->email;
- print '
';
-
- // Ref
- print '';
- print '';
- print '';
- print $propalstatic->getNomUrl(1);
- print ' ';
- print '';
- if ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) print img_warning($langs->trans("Late"));
- print ' ';
- print '';
$filename = dol_sanitizeFileName($obj->ref);
$filedir = $conf->propal->multidir_output[$obj->entity].'/'.dol_sanitizeFileName($obj->ref);
$urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->propalid;
- print $formfile->getDocumentsLink($propalstatic->element, $filename, $filedir);
- print '
';
- print " ";
+ $warning = ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) ? img_warning($langs->trans("Late")) : '';
+
+ print ' ';
+
+ print '';
+ print '';
+ print ''.$propalstatic->getNomUrl(1).' ';
+ print ''.$warning.' ';
+ print ''.$formfile->getDocumentsLink($propalstatic->element, $filename, $filedir).' ';
+ print ' ';
+ print '
';
+ print ' ';
print ''.$companystatic->getNomUrl(1, 'customer', 44).' ';
print ''.dol_print_date($db->jdate($obj->dp), 'day').' ';
@@ -690,7 +648,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
print ' ';
$i++;
- $total += $obj->total_ttc;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -704,21 +662,17 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
/*
- * Opened Order
+ * Opened (validated) order
*/
if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
- $langs->load("orders");
-
- $sql = "SELECT s.nom as name, s.rowid, c.rowid as commandeid, c.total_ttc, c.total_ht, c.tva as total_tva, c.ref, c.ref_client, c.fk_statut, c.date_valid as dv, c.facture as billed";
- $sql .= ", s.code_client";
- $sql .= ", s.entity";
- $sql .= ", s.email";
- $sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
- $sql .= ", ".MAIN_DB_PREFIX."commande as c";
+ $sql = "SELECT c.rowid as commandeid, c.total_ttc, c.total_ht, c.tva as total_tva, c.ref, c.ref_client, c.fk_statut, c.date_valid as dv, c.facture as billed";
+ $sql .= ", s.nom as name, s.rowid, s.code_client, s.entity, s.email";
+ $sql .= " FROM ".MAIN_DB_PREFIX."commande as c";
+ $sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE c.fk_soc = s.rowid";
- $sql .= " AND c.entity IN (".getEntity('commande').")";
- $sql .= " AND (c.fk_statut = ".Commande::STATUS_VALIDATED." or c.fk_statut = ".Commande::STATUS_SHIPMENTONPROCESS.")";
+ $sql .= " WHERE c.entity IN (".getEntity($orderstatic->element).")";
+ $sql .= " AND c.fk_soc = s.rowid";
+ $sql .= " AND c.fk_statut IN (".Commande::STATUS_VALIDATED.", ".Commande::STATUS_SHIPMENTONPROCESS.")";
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
if ($socid) $sql .= " AND s.rowid = ".$socid;
$sql .= " ORDER BY c.rowid DESC";
@@ -728,7 +682,7 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
$total = 0;
$num = $db->num_rows($resql);
$nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- startSimpleTable("OrdersOpened", "commande/list.php", "search_status=1", 4, $num);
+ startSimpleTable("OrdersOpened", "commande/list.php", "search_status=".Commande::STATUS_VALIDATED, 4, $num);
if ($num > 0) {
$i = 0;
@@ -752,33 +706,31 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
$companystatic->entity = $obj->entity;
$companystatic->email = $obj->email;
- print '
';
-
- // Ref
- print '';
- print '';
- print '';
- print $orderstatic->getNomUrl(1);
- print ' ';
- print '';
- //if ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) print img_warning($langs->trans("Late"));
- print ' ';
- print '';
$filename = dol_sanitizeFileName($obj->ref);
$filedir = $conf->commande->dir_output.'/'.dol_sanitizeFileName($obj->ref);
$urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->propalid;
- print $formfile->getDocumentsLink($orderstatic->element, $filename, $filedir);
- print '
';
- print " ";
+ //$warning = ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) ? img_warning($langs->trans("Late")) : '';
+
+ print ' ';
+
+ print '';
+ print '';
+ print ''.$orderstatic->getNomUrl(1).' ';
+ print ''.$formfile->getDocumentsLink($orderstatic->element, $filename, $filedir).' ';
+ print ' ';
+ print '
';
+ print ' ';
print ''.$companystatic->getNomUrl(1, 'customer', 44).' ';
print ''.dol_print_date($db->jdate($obj->dp), 'day').' ';
print ''.price(!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc).' ';
print ''.$orderstatic->LibStatut($obj->fk_statut, $obj->billed, 3).' ';
- print ' '."\n";
+
+ print '';
$i++;
- $total += $obj->total_ttc;
+ $total +=(!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
}
@@ -790,7 +742,9 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
}
}
-print '
';
// Editeur wysiwyg
require_once DOL_DOCUMENT_ROOT.'/core/class/doleditor.class.php';
- $doleditor = new DolEditor('bodyemail', GETPOST('bodyemail', 'none'), '', 600, 'dolibarr_mailings', '', true, true, $conf->global->FCKEDITOR_ENABLE_MAILING, 20, '90%');
+ $doleditor = new DolEditor('bodyemail', GETPOST('bodyemail', 'restricthtml'), '', 600, 'dolibarr_mailings', '', true, true, $conf->global->FCKEDITOR_ENABLE_MAILING, 20, '90%');
$doleditor->Create();
print '
';
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index 27e0c2e5b0c..be0518be553 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -42,7 +42,7 @@ if (!$user->rights->mailing->lire || $user->socid > 0) accessforbidden();
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php
index 15785060809..f42b82718e6 100644
--- a/htdocs/comm/propal/card.php
+++ b/htdocs/comm/propal/card.php
@@ -68,7 +68,7 @@ $error = 0;
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$socid = GETPOST('socid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$origin = GETPOST('origin', 'alpha');
$originid = GETPOST('originid', 'int');
@@ -355,8 +355,8 @@ if (empty($reshook))
$object->fk_project = GETPOST('projectid', 'int');
$object->model_pdf = GETPOST('model');
$object->author = $user->id; // deprecated
- $object->note_private = GETPOST('note_private', 'none');
- $object->note_public = GETPOST('note_public', 'none');
+ $object->note_private = GETPOST('note_private', 'restricthtml');
+ $object->note_public = GETPOST('note_public', 'restricthtml');
$object->statut = Propal::STATUS_DRAFT;
$object->fk_incoterms = GETPOST('incoterm_id', 'int');
$object->location_incoterms = GETPOST('location_incoterms', 'alpha');
@@ -383,8 +383,8 @@ if (empty($reshook))
$object->fk_project = GETPOST('projectid', 'int');
$object->model_pdf = GETPOST('model');
$object->author = $user->id; // deprecated
- $object->note_private = GETPOST('note_private', 'none');
- $object->note_public = GETPOST('note_public', 'none');
+ $object->note_private = GETPOST('note_private', 'restricthtml');
+ $object->note_public = GETPOST('note_public', 'restricthtml');
$object->fk_incoterms = GETPOST('incoterm_id', 'int');
$object->location_incoterms = GETPOST('location_incoterms', 'alpha');
@@ -627,7 +627,7 @@ if (empty($reshook))
{
$db->begin();
- $result = $object->cloture($user, GETPOST('statut', 'int'), GETPOST('note_private', 'none'));
+ $result = $object->cloture($user, GETPOST('statut', 'int'), GETPOST('note_private', 'restricthtml'));
if ($result < 0)
{
setEventMessages($object->error, $object->errors, 'errors');
@@ -792,9 +792,9 @@ if (empty($reshook))
} elseif ($action == 'addline' && $usercancreate) { // Add line
// Set if we used free entry or predefined product
$predef = '';
- $product_desc = (GETPOST('dp_desc', 'none') ?GETPOST('dp_desc', 'none') : '');
- $price_ht = GETPOST('price_ht');
- $price_ht_devise = GETPOST('multicurrency_price_ht');
+ $product_desc = (GETPOSTISSET('dp_desc') ?GETPOST('dp_desc', 'restricthtml') : '');
+ $price_ht = price2num(GETPOST('price_ht'));
+ $price_ht_devise = price2num(GETPOST('multicurrency_price_ht'));
$prod_entry_mode = GETPOST('prod_entry_mode');
if ($prod_entry_mode == 'free')
{
@@ -1152,7 +1152,7 @@ if (empty($reshook))
$info_bits |= 0x01;
// Clean parameters
- $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'none'));
+ $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'restricthtml'));
// Define vat_rate
$vat_rate = (GETPOST('tva_tx') ? GETPOST('tva_tx') : 0);
@@ -1316,7 +1316,7 @@ if (empty($reshook))
$object->oldcopy = dol_clone($object);
// Fill array 'array_options' with data from update form
- $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'none'));
+ $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'restricthtml'));
if ($ret < 0) $error++;
if (!$error)
{
diff --git a/htdocs/comm/propal/contact.php b/htdocs/comm/propal/contact.php
index c2f60516f1c..16be5930e89 100644
--- a/htdocs/comm/propal/contact.php
+++ b/htdocs/comm/propal/contact.php
@@ -38,7 +38,7 @@ $langs->loadLangs(array('facture', 'orders', 'sendings', 'companies'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$lineid = GETPOST('lineid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
if ($user->socid) $socid = $user->socid;
diff --git a/htdocs/comm/propal/index.php b/htdocs/comm/propal/index.php
index 9e138c52cbe..692f561867a 100644
--- a/htdocs/comm/propal/index.php
+++ b/htdocs/comm/propal/index.php
@@ -1,8 +1,9 @@
- * Copyright (C) 2004-2017 Laurent Destailleur
- * Copyright (C) 2005-2012 Regis Houssin
- * Copyright (C) 2019 Nicolas ZABOURI
+/* Copyright (C) 2003-2004 Rodolphe Quiedeville
+ * Copyright (C) 2004-2017 Laurent Destailleur
+ * Copyright (C) 2005-2012 Regis Houssin
+ * Copyright (C) 2019 Nicolas ZABOURI
+ * Copyright (C) 2020 Tobias Sekan
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -19,22 +20,12 @@
*/
/**
- * \file htdocs/comm/propal/index.php
- * \ingroup propal
- * \brief Home page of proposal area
+ * \file htdocs/comm/propal/index.php
+ * \ingroup propal
+ * \brief Home page of proposal area
*/
require '../../main.inc.php';
-require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
-require_once DOL_DOCUMENT_ROOT.'/comm/propal/class/propal.class.php';
-
-$hookmanager = new HookManager($db);
-
-// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
-$hookmanager->initHooks(array('proposalindex'));
-
-// Load translation files required by the page
-$langs->loadLangs(array('propal', 'companies'));
// Security check
$socid = GETPOST('socid', 'int');
@@ -43,13 +34,24 @@ if (isset($user->socid) && $user->socid > 0)
$action = '';
$socid = $user->socid;
}
-$result = restrictedArea($user, 'propal');
+restrictedArea($user, 'propal');
+require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
+require_once DOL_DOCUMENT_ROOT.'/comm/propal/class/propal.class.php';
+
+// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
+$hookmanager = new HookManager($db);
+$hookmanager->initHooks(array('proposalindex'));
+
+// Load translation files required by the page
+$langs->loadLangs(array('propal', 'companies'));
+
+$now = dol_now();
+$max = 5;
/*
* View
*/
-$now = dol_now();
$propalstatic = new Propal($db);
$companystatic = new Societe($db);
$form = new Form($db);
@@ -60,192 +62,218 @@ llxHeader("", $langs->trans("ProspectionArea"), $help_url);
print load_fiche_titre($langs->trans("ProspectionArea"), '', 'propal');
-//print '';
-//print '';
-print '';
+print '
';
+print '
';
-
-if (!empty($conf->global->MAIN_SEARCH_FORM_ON_HOME_AREAS)) // This is useless due to the global search combo
+// This is useless due to the global search combo
+if (!empty($conf->global->MAIN_SEARCH_FORM_ON_HOME_AREAS))
{
- print '
\n";
-}
+ print '
';
+ print '
';
+}
/*
* Statistics
*/
+$listofstatus = array(Propal::STATUS_DRAFT, Propal::STATUS_VALIDATED, Propal::STATUS_SIGNED, Propal::STATUS_NOTSIGNED, Propal::STATUS_BILLED);
$sql = "SELECT count(p.rowid) as nb, p.fk_statut as status";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
$sql .= ", ".MAIN_DB_PREFIX."propal as p";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
-$sql .= " WHERE p.fk_soc = s.rowid";
-$sql .= " AND p.entity IN (".getEntity('propal').")";
+$sql .= " WHERE p.entity IN (".getEntity($propalstatic->element).")";
+$sql .= " AND p.fk_soc = s.rowid";
if ($user->socid) $sql .= ' AND p.fk_soc = '.$user->socid;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
-$sql .= " AND p.fk_statut IN (0,1,2,3,4)";
+$sql .= " AND p.fk_statut IN (".implode(" ,", $listofstatus).")";
$sql .= " GROUP BY p.fk_statut";
$resql = $db->query($sql);
if ($resql)
{
- $num = $db->num_rows($resql);
- $i = 0;
+ $num = $db->num_rows($resql);
+ $i = 0;
+ $total = 0;
+ $totalinprocess = 0;
+ $dataseries = array();
+ $colorseries = array();
+ $vals = array();
- $total = 0;
- $totalinprocess = 0;
- $dataseries = array();
- $colorseries = array();
- $vals = array();
+ while ($i < $num)
+ {
+ $obj = $db->fetch_object($resql);
+ if ($obj)
+ {
+ $vals[$obj->status] = $obj->nb;
+ $totalinprocess += $obj->nb;
- // -1=Canceled, 0=Draft, 1=Validated, (2=Accepted/On process not managed for customer orders), 3=Closed (Sent/Received, billed or not)
- while ($i < $num)
- {
- $obj = $db->fetch_object($resql);
- if ($obj)
- {
- $vals[$obj->status] = $obj->nb;
- $totalinprocess += $obj->nb;
+ $total += $obj->nb;
+ }
+ $i++;
+ }
+ $db->free($resql);
- $total += $obj->nb;
- }
- $i++;
- }
- $db->free($resql);
+ include_once DOL_DOCUMENT_ROOT.'/theme/'.$conf->theme.'/theme_vars.inc.php';
- include_once DOL_DOCUMENT_ROOT.'/theme/'.$conf->theme.'/theme_vars.inc.php';
+ print '
';
+ print '
';
- print '';
- print '
';
- print ''.$langs->trans("Statistics").' - '.$langs->trans("Proposals").' ';
+ print ''.$langs->trans("Statistics").' - '.$langs->trans("Proposals").' ';
+ print ' ';
- if (empty($conf->use_javascript_ajax))
- {
- print '';
- print ''.$propalstatic->LibStatut($status, 0).' ';
- print ''.(isset($vals[$status]) ? $vals[$status] : 0).' \n";
- }
- }
- if ($conf->use_javascript_ajax)
- {
- print '';
+ foreach ($listofstatus as $status) {
+ $dataseries[] = array($propalstatic->LibStatut($status, 1), (isset($vals[$status]) ? (int) $vals[$status] : 0));
+ if ($status == Propal::STATUS_DRAFT) $colorseries[$status] = '-'.$badgeStatus0;
+ if ($status == Propal::STATUS_VALIDATED) $colorseries[$status] = $badgeStatus1;
+ if ($status == Propal::STATUS_SIGNED) $colorseries[$status] = $badgeStatus4;
+ if ($status == Propal::STATUS_NOTSIGNED) $colorseries[$status] = $badgeStatus9;
+ if ($status == Propal::STATUS_BILLED) $colorseries[$status] = $badgeStatus6;
- include_once DOL_DOCUMENT_ROOT.'/core/class/dolgraph.class.php';
- $dolgraph = new DolGraph();
- $dolgraph->SetData($dataseries);
- $dolgraph->SetDataColor(array_values($colorseries));
- $dolgraph->setShowLegend(2);
- $dolgraph->setShowPercent(1);
- $dolgraph->SetType(array('pie'));
- $dolgraph->setHeight('200');
- $dolgraph->draw('idgraphthirdparties');
- print $dolgraph->show($total ? 0 : 1);
+ if (empty($conf->use_javascript_ajax)) {
+ print ' ';
+ print ''.$propalstatic->LibStatut($status, 0).' ';
+ print ''.(isset($vals[$status]) ? $vals[$status] : 0).' \n";
+ }
+ }
- print '';
- }
- //if ($totalinprocess != $total)
- //print ''.$langs->trans("Total").' ('.$langs->trans("CustomersOrdersRunning").') '.$totalinprocess.' '.$langs->trans("Total").' '.$total.'
';
+ print '';
+
+ include_once DOL_DOCUMENT_ROOT.'/core/class/dolgraph.class.php';
+ $dolgraph = new DolGraph();
+ $dolgraph->SetData($dataseries);
+ $dolgraph->SetDataColor(array_values($colorseries));
+ $dolgraph->setShowLegend(2);
+ $dolgraph->setShowPercent(1);
+ $dolgraph->SetType(array('pie'));
+ $dolgraph->setHeight('200');
+ $dolgraph->draw('idgraphthirdparties');
+ print $dolgraph->show($total ? 0 : 1);
+
+ print ' ';
+ print ' ';
+ }
+
+ //if ($totalinprocess != $total)
+ //{
+ // print '';
+ // print ''.$langs->trans("Total").' ('.$langs->trans("CustomersOrdersRunning").') ';
+ // print ''.$totalinprocess.' ';
+ // print ' ';
+ //}
+
+ print '';
+ print ''.$langs->trans("Total").' ';
+ print ''.$total.' ';
+ print ' ';
+
+ print '
';
+ print '
';
+ print '
';
} else {
- dol_print_error($db);
+ dol_print_error($db);
}
/*
* Draft proposals
*/
-if (!empty($conf->propal->enabled))
-{
- $sql = "SELECT c.rowid, c.ref, s.nom as socname, s.rowid as socid, s.canvas, s.client";
- $sql .= " FROM ".MAIN_DB_PREFIX."propal as c";
+if (!empty($conf->propal->enabled)) {
+ $sql = "SELECT p.rowid, p.ref, p.ref_client, p.total_ht, p.tva as total_tva, p.total as total_ttc";
+ $sql .= ", s.rowid as socid, s.nom as name, s.client, s.canvas, s.code_client, s.email, s.entity, s.code_compta";
+ $sql .= " FROM ".MAIN_DB_PREFIX."propal as p";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql .= " WHERE c.fk_soc = s.rowid";
- $sql .= " AND c.entity IN (".getEntity('propal').")";
- $sql .= " AND c.fk_statut = 0";
- if ($socid) $sql .= " AND c.fk_soc = ".$socid;
+ $sql .= " WHERE p.entity IN (".getEntity($propalstatic->element).")";
+ $sql .= " AND p.fk_soc = s.rowid";
+ $sql .= " AND p.fk_statut =".Propal::STATUS_DRAFT;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
+ if ($socid) $sql .= " AND p.fk_soc = ".$socid;
$resql = $db->query($sql);
- if ($resql)
- {
+ if ($resql) {
$num = $db->num_rows($resql);
- if ($num)
- {
- print '
';
- print '
';
- print '';
- $langs->load("propal");
- print ''.$langs->trans("DraftPropals").' '.$num.' ';
+ $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
+ startSimpleTable("DraftPropals", "comm/propal/list.php", "search_status=".Propal::STATUS_DRAFT, 2, $num);
+ if ($num) {
+ $total = 0;
$i = 0;
- $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
- while ($i < $nbofloop)
- {
+
+ while ($i < $nbofloop) {
$obj = $db->fetch_object($resql);
- print '';
$propalstatic->id = $obj->rowid;
$propalstatic->ref = $obj->ref;
- print ''.$propalstatic->getNomUrl(1).' ';
+ $propalstatic->ref_client = $obj->ref_client;
+ $propalstatic->total_ht = $obj->total_ht;
+ $propalstatic->total_tva = $obj->total_tva;
+ $propalstatic->total_ttc = $obj->total_ttc;
$companystatic->id = $obj->socid;
- $companystatic->name = $obj->socname;
+ $companystatic->name = $obj->name;
$companystatic->client = $obj->client;
+ $companystatic->code_client = $obj->code_client;
+ $companystatic->code_fournisseur = $obj->code_fournisseur;
$companystatic->canvas = $obj->canvas;
- print ''.$companystatic->getNomUrl(1, 'customer', 24).' ';
+ $companystatic->entity = $obj->entity;
+ $companystatic->email = $obj->email;
+ $companystatic->code_compta = $obj->code_compta;
+ print ' ';
+ print ''.$propalstatic->getNomUrl(1).' ';
+ print ''.$companystatic->getNomUrl(1, 'customer', 16).' ';
+ print ''.price(!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc).' ';
print ' ';
+
$i++;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
- if ($num > $nbofloop)
- {
- print ''.$langs->trans("XMoreLines", ($num - $nbofloop))." '.$langs->trans("Total").' '.price($total)."
";
- print "
";
}
+
+ addSummaryTableLine(3, $num, $nbofloop, $total, "NoProposal");
+ finishSimpleTable(true);
+ $db->free($resql);
+ } else {
+ dol_print_error($db);
}
}
+print '
';
-//print '
';
-print '';
-
-
-$max = 5;
+print '
';
+print '
';
/*
* Last modified proposals
*/
-$sql = "SELECT c.rowid, c.entity, c.ref, c.fk_statut, s.nom as socname, s.rowid as socid, s.canvas, s.client,";
-$sql .= " date_cloture as datec";
+$sql = "SELECT c.rowid, c.entity, c.ref, c.fk_statut, date_cloture as datec";
+$sql .= ", s.nom as socname, s.rowid as socid, s.canvas, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."propal as c";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
-$sql .= " WHERE c.fk_soc = s.rowid";
-$sql .= " AND c.entity IN (".getEntity('propal').")";
+$sql .= " WHERE c.entity IN (".getEntity($propalstatic->element).")";
+$sql .= " AND c.fk_soc = s.rowid";
//$sql.= " AND c.fk_statut > 2";
if ($socid) $sql .= " AND c.fk_soc = ".$socid;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
@@ -253,150 +281,126 @@ $sql .= " ORDER BY c.tms DESC";
$sql .= $db->plimit($max, 0);
$resql = $db->query($sql);
-if ($resql)
-{
- print '
';
- print '
';
- print '';
- print ''.$langs->trans("LastModifiedProposals", $max).' ';
-
+if ($resql) {
$num = $db->num_rows($resql);
- if ($num)
- {
- $i = 0;
- while ($i < $num)
- {
- $obj = $db->fetch_object($resql);
+ startSimpleTable($langs->trans("LastModifiedProposals", $max), "", "", 3);
- print '';
- print '';
+ if ($num) {
+ $i = 0;
+ while ($i < $num) {
+ $obj = $db->fetch_object($resql);
$propalstatic->id = $obj->rowid;
$propalstatic->ref = $obj->ref;
- print '';
- print '';
- print $propalstatic->getNomUrl(1);
- print ' ';
-
- print '';
- print ' ';
- print ' ';
-
- print '';
- $filename = dol_sanitizeFileName($obj->ref);
- $filedir = $conf->propal->multidir_output[$obj->entity].'/'.dol_sanitizeFileName($obj->ref);
- $urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->rowid;
- print $formfile->getDocumentsLink($propalstatic->element, $filename, $filedir);
- print '
';
-
- print ' ';
-
$companystatic->id = $obj->socid;
$companystatic->name = $obj->socname;
$companystatic->client = $obj->client;
$companystatic->canvas = $obj->canvas;
- print ''.$companystatic->getNomUrl(1, 'customer').' ';
- print ''.dol_print_date($db->jdate($obj->datec), 'day').' ';
+ $filename = dol_sanitizeFileName($obj->ref);
+ $filedir = $conf->propal->multidir_output[$obj->entity].'/'.dol_sanitizeFileName($obj->ref);
+ $urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->rowid;
- print ''.$propalstatic->LibStatut($obj->fk_statut, 3).' ';
+ print ' ';
+
+ print '';
+ print '';
+ print '';
+ print ''.$propalstatic->getNomUrl(1).' ';
+ print ''.$formfile->getDocumentsLink($propalstatic->element, $filename, $filedir).' ';
print ' ';
+ print '
';
+ print ' ';
+
+ print ''.$companystatic->getNomUrl(1, 'customer').' ';
+ print ''.dol_print_date($db->jdate($obj->datec), 'day').' ';
+ print ''.$propalstatic->LibStatut($obj->fk_statut, 3).' ';
+
+ print ' ';
+
$i++;
}
}
- print "
";
- print "
";
-} else dol_print_error($db);
+
+ finishSimpleTable(true);
+ $db->free($resql);
+} else {
+ dol_print_error($db);
+}
/*
- * Open proposals
+ * Open (validated) proposals
*/
-if (!empty($conf->propal->enabled) && $user->rights->propale->lire)
-{
- $langs->load("propal");
-
- $now = dol_now();
-
+if (!empty($conf->propal->enabled) && $user->rights->propale->lire) {
$sql = "SELECT s.nom as socname, s.rowid as socid, s.canvas, s.client";
$sql .= ", p.rowid as propalid, p.entity, p.total as total_ttc, p.total_ht, p.ref, p.fk_statut, p.datep as dp, p.fin_validite as dfv";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
$sql .= ", ".MAIN_DB_PREFIX."propal as p";
if (!$user->rights->societe->client->voir && !$socid) $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql .= " WHERE p.fk_soc = s.rowid";
- $sql .= " AND p.entity IN (".getEntity('propal').")";
- $sql .= " AND p.fk_statut = 1";
+ $sql .= " AND p.entity IN (".getEntity($propalstatic->element).")";
+ $sql .= " AND p.fk_statut = ".Propal::STATUS_VALIDATED;
if (!$user->rights->societe->client->voir && !$socid) $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
if ($socid) $sql .= " AND s.rowid = ".$socid;
$sql .= " ORDER BY p.rowid DESC";
- $result = $db->query($sql);
- if ($result)
- {
+ $resql = $db->query($sql);
+ if ($resql) {
$total = 0;
- $num = $db->num_rows($result);
- $i = 0;
- if ($num > 0)
- {
- print '
';
- print '
';
- print ''.$langs->trans("ProposalsOpened").' '.$num.' ';
-
- // Ref
- print '';
+ if ($num > 0) {
+ $i = 0;
+ while ($i < $nbofloop) {
+ $obj = $db->fetch_object($resql);
$propalstatic->id = $obj->propalid;
$propalstatic->ref = $obj->ref;
- print '';
- print '';
- print $propalstatic->getNomUrl(1);
- print ' ';
- print '';
- if ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) print img_warning($langs->trans("Late"));
- print ' ';
- print '';
- $filename = dol_sanitizeFileName($obj->ref);
- $filedir = $conf->propal->multidir_output[$obj->entity].'/'.dol_sanitizeFileName($obj->ref);
- $urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->propalid;
- print $formfile->getDocumentsLink($propalstatic->element, $filename, $filedir);
- print '
';
-
- print " ";
-
$companystatic->id = $obj->socid;
$companystatic->name = $obj->socname;
$companystatic->client = $obj->client;
$companystatic->canvas = $obj->canvas;
- print ''.$companystatic->getNomUrl(1, 'customer', 44).' '."\n";
- print ''.dol_print_date($db->jdate($obj->dp), 'day').' '."\n";
+ $filename = dol_sanitizeFileName($obj->ref);
+ $filedir = $conf->propal->multidir_output[$obj->entity].'/'.dol_sanitizeFileName($obj->ref);
+ $urlsource = $_SERVER['PHP_SELF'].'?id='.$obj->propalid;
- print ''.price($obj->total_ttc).' ';
+ $warning = ($db->jdate($obj->dfv) < ($now - $conf->propal->cloture->warning_delay)) ? img_warning($langs->trans("Late")) : '';
+
+ print ' ';
+
+ // Ref
+ print '';
+ print '';
+ print '';
+ print ''.$propalstatic->getNomUrl(1).' ';
+ print ''.$warning.' ';
+ print ''.$formfile->getDocumentsLink($propalstatic->element, $filename, $filedir).' ';
+ print ' ';
+ print '
';
+ print ' ';
+
+ print ''.$companystatic->getNomUrl(1, 'customer', 44).' ';
+ print ''.dol_print_date($db->jdate($obj->dp), 'day').' ';
+ print ''.price(!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc).' ';
+ print ''.$propalstatic->LibStatut($obj->fk_statut, 3).' ';
+
+ print ' ';
- print ''.$propalstatic->LibStatut($obj->fk_statut, 3).' '."\n";
- print ''."\n";
$i++;
- $total += $obj->total_ttc;
+ $total += (!empty($conf->global->MAIN_DASHBOARD_USE_TOTAL_HT) ? $obj->total_ht : $obj->total_ttc);
}
- if ($num > $nbofloop)
- {
- print ''.$langs->trans("XMoreLines", ($num - $nbofloop))." '.$langs->trans("Total")." ".price($total)."
";
- print "
";
}
+
+ addSummaryTableLine(5, $num, $nbofloop, $total, "None", true);
+ finishSimpleTable(true);
+ $db->free($resql);
} else {
dol_print_error($db);
}
@@ -405,6 +409,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propale->lire)
/*
* Proposals to process
*/
+
/*
if (! empty($conf->propal->enabled))
{
@@ -479,7 +484,9 @@ if (! empty($conf->propal->enabled))
/*
* Proposal that are in a shipping process
*/
-/*if (! empty($conf->propal->enabled))
+
+/*
+if (! empty($conf->propal->enabled))
{
$sql = "SELECT c.rowid, c.ref, c.fk_statut, c.facture, s.nom as name, s.rowid as socid";
$sql.= " FROM ".MAIN_DB_PREFIX."commande as c";
@@ -548,8 +555,9 @@ if (! empty($conf->propal->enabled))
}
*/
-//print '
';
-print '';
+print '';
+print '';
+print '';
$parameters = array('user' => $user);
$reshook = $hookmanager->executeHooks('dashboardPropals', $parameters, $object); // Note that $action and $object may have been modified by hook
diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php
index f066edb8fb2..1391bc4e1fd 100644
--- a/htdocs/comm/propal/list.php
+++ b/htdocs/comm/propal/list.php
@@ -50,7 +50,7 @@ $langs->loadLangs(array('companies', 'propal', 'compta', 'bills', 'orders', 'pro
$socid = GETPOST('socid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
diff --git a/htdocs/comm/propal/note.php b/htdocs/comm/propal/note.php
index 06385bd40e9..ef35903fcd0 100644
--- a/htdocs/comm/propal/note.php
+++ b/htdocs/comm/propal/note.php
@@ -38,7 +38,7 @@ $langs->loadLangs(array('propal', 'compta', 'bills', 'companies'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
if ($user->socid) $socid = $user->socid;
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index ffd4c1738c0..16a7d362ba6 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -35,7 +35,7 @@ $langs->loadLangs(array('orders', 'bills', 'companies'));
$id = GETPOST('id', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$backtopage = GETPOST('backtopage', 'alpha');
// Security check
diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php
index c2536ee59d6..d48e990e7e8 100644
--- a/htdocs/commande/card.php
+++ b/htdocs/commande/card.php
@@ -67,7 +67,7 @@ if (!empty($conf->productbatch->enabled)) $langs->load("productbatch");
$id = (GETPOST('id', 'int') ? GETPOST('id', 'int') : GETPOST('orderid', 'int'));
$ref = GETPOST('ref', 'alpha');
$socid = GETPOST('socid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
$lineid = GETPOST('lineid', 'int');
@@ -263,8 +263,8 @@ if (empty($reshook))
$db->begin();
$object->date_commande = $datecommande;
- $object->note_private = GETPOST('note_private', 'none');
- $object->note_public = GETPOST('note_public', 'none');
+ $object->note_private = GETPOST('note_private', 'restricthtml');
+ $object->note_public = GETPOST('note_public', 'restricthtml');
$object->source = GETPOST('source_id');
$object->fk_project = GETPOST('projectid', 'int');
$object->ref_client = GETPOST('ref_client', 'alpha');
@@ -992,7 +992,7 @@ if (empty($reshook))
$date_end = '';
$date_start = dol_mktime(GETPOST('date_starthour'), GETPOST('date_startmin'), GETPOST('date_startsec'), GETPOST('date_startmonth'), GETPOST('date_startday'), GETPOST('date_startyear'));
$date_end = dol_mktime(GETPOST('date_endhour'), GETPOST('date_endmin'), GETPOST('date_endsec'), GETPOST('date_endmonth'), GETPOST('date_endday'), GETPOST('date_endyear'));
- $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'none'));
+ $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'restricthtml'));
$pu_ht = GETPOST('price_ht');
$vat_rate = (GETPOST('tva_tx') ?GETPOST('tva_tx') : 0);
$pu_ht_devise = GETPOST('multicurrency_subprice');
@@ -1256,7 +1256,7 @@ if (empty($reshook))
$object->oldcopy = dol_clone($object);
// Fill array 'array_options' with data from update form
- $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'none'));
+ $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'restricthtml'));
if ($ret < 0) $error++;
if (!$error)
diff --git a/htdocs/commande/contact.php b/htdocs/commande/contact.php
index 2d11feeeee2..f44813a4994 100644
--- a/htdocs/commande/contact.php
+++ b/htdocs/commande/contact.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array('orders', 'sendings', 'companies'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
if ($user->socid) $socid = $user->socid;
diff --git a/htdocs/commande/note.php b/htdocs/commande/note.php
index 9054252e6d9..9922d3b0e3e 100644
--- a/htdocs/commande/note.php
+++ b/htdocs/commande/note.php
@@ -38,7 +38,7 @@ $langs->loadLangs(array('companies', 'bills', 'orders'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$socid = GETPOST('socid', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
$socid = 0;
diff --git a/htdocs/compta/accounting-files.php b/htdocs/compta/accounting-files.php
index 0c20e46e316..d73e7228b82 100644
--- a/htdocs/compta/accounting-files.php
+++ b/htdocs/compta/accounting-files.php
@@ -60,7 +60,7 @@ $date_stopMonth = GETPOST('date_stopmonth', 'int');
$date_stopYear = GETPOST('date_stopyear', 'int');
//FIXME doldate
$date_stop = ($date_stopDay) ?dol_mktime(23, 59, 59, $date_stopMonth, $date_stopDay, $date_stopYear) : strtotime($date_stop);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
$hookmanager->initHooks(array('comptafileslist', 'globallist'));
@@ -68,7 +68,7 @@ $hookmanager->initHooks(array('comptafileslist', 'globallist'));
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/bank/account_statement_document.php b/htdocs/compta/bank/account_statement_document.php
index 1e9c6e3b358..3b8423b68dc 100644
--- a/htdocs/compta/bank/account_statement_document.php
+++ b/htdocs/compta/bank/account_statement_document.php
@@ -38,7 +38,7 @@ $langs->loadLangs(array('banks', 'companies', 'other'));
$id = (GETPOST('id', 'int') ? GETPOST('id', 'int') : GETPOST('account', 'int'));
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$numref = (GETPOST('num', 'alpha') ? GETPOST('num', 'alpha') : GETPOST('sectionid', 'alpha'));
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index 9e1d1dedfc7..1573a226521 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -56,7 +56,7 @@ $langs->loadLangs(array("banks", "bills", "categories", "companies", "margins",
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
$contextpage = 'banktransactionlist'.(empty($object->ref) ? '' : '-'.$object->id);
diff --git a/htdocs/compta/bank/card.php b/htdocs/compta/bank/card.php
index c99f303210b..7d9e825ce08 100644
--- a/htdocs/compta/bank/card.php
+++ b/htdocs/compta/bank/card.php
@@ -115,7 +115,7 @@ if ($action == 'add')
$object->min_allowed = GETPOST("account_min_allowed", 'int');
$object->min_desired = GETPOST("account_min_desired", 'int');
- $object->comment = trim(GETPOST("account_comment", 'none'));
+ $object->comment = trim(GETPOST("account_comment", 'restricthtml'));
$object->fk_user_author = $user->id;
@@ -213,7 +213,7 @@ if ($action == 'update')
$object->min_allowed = GETPOST("account_min_allowed", 'int');
$object->min_desired = GETPOST("account_min_desired", 'int');
- $object->comment = trim(GETPOST("account_comment", 'none'));
+ $object->comment = trim(GETPOST("account_comment", 'restricthtml'));
if ($conf->global->MAIN_BANK_ACCOUNTANCY_CODE_ALWAYS_REQUIRED && empty($object->account_number))
{
diff --git a/htdocs/compta/bank/document.php b/htdocs/compta/bank/document.php
index e3863cd2922..2bd95409827 100644
--- a/htdocs/compta/bank/document.php
+++ b/htdocs/compta/bank/document.php
@@ -36,7 +36,7 @@ $langs->loadLangs(array('banks', 'companies', 'other'));
$id = (GETPOST('id', 'int') ? GETPOST('id', 'int') : GETPOST('account', 'int'));
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php
index 976c6997bdd..0da5a557647 100644
--- a/htdocs/compta/bank/line.php
+++ b/htdocs/compta/bank/line.php
@@ -43,7 +43,7 @@ if (!empty($conf->salaries->enabled)) $langs->load("salaries");
$id = (GETPOST('id', 'int') ? GETPOST('id', 'int') : GETPOST('account', 'int'));
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$rowid = GETPOST("rowid", 'int');
$orig_account = GETPOST("orig_account");
diff --git a/htdocs/compta/bank/list.php b/htdocs/compta/bank/list.php
index a97d4452e2d..5cdd4711871 100644
--- a/htdocs/compta/bank/list.php
+++ b/htdocs/compta/bank/list.php
@@ -39,7 +39,7 @@ if (!empty($conf->categorie->enabled)) require_once DOL_DOCUMENT_ROOT.'/categori
// Load translation files required by the page
$langs->loadLangs(array('banks', 'categories', 'accountancy', 'compta'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
diff --git a/htdocs/compta/bank/releve.php b/htdocs/compta/bank/releve.php
index aee53fe3f23..ba5e20c11c1 100644
--- a/htdocs/compta/bank/releve.php
+++ b/htdocs/compta/bank/releve.php
@@ -48,7 +48,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions.lib.php';
// Load translation files required by the page
$langs->loadLangs(array("banks", "categories", "companies", "bills", "trips", "donations", "loan"));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('account', 'int') ? GETPOST('account', 'int') : GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$dvid = GETPOST('dvid', 'alpha');
diff --git a/htdocs/compta/bank/transfer.php b/htdocs/compta/bank/transfer.php
index 7228c38fe50..70903f9120f 100644
--- a/htdocs/compta/bank/transfer.php
+++ b/htdocs/compta/bank/transfer.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array("banks", "categories", "multicurrency"));
if (!$user->rights->banque->transfer)
accessforbidden();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$error = 0;
diff --git a/htdocs/compta/bank/various_payment/card.php b/htdocs/compta/bank/various_payment/card.php
index 071a5abf0a9..20eab8b349e 100644
--- a/htdocs/compta/bank/various_payment/card.php
+++ b/htdocs/compta/bank/various_payment/card.php
@@ -107,8 +107,8 @@ if (empty($reshook))
$object->datev = $datev;
$object->datep = $datep;
$object->amount = price2num(GETPOST("amount", 'alpha'));
- $object->label = GETPOST("label", 'none');
- $object->note = GETPOST("note", 'none');
+ $object->label = GETPOST("label", 'restricthtml');
+ $object->note = GETPOST("note", 'restricthtml');
$object->type_payment = GETPOST("paymenttype", 'int') > 0 ? GETPOST("paymenttype", "int") : 0;
$object->num_payment = GETPOST("num_payment", 'alpha');
$object->fk_user_author = $user->id;
diff --git a/htdocs/compta/bank/various_payment/document.php b/htdocs/compta/bank/various_payment/document.php
index 7a89fd77986..267908cde41 100644
--- a/htdocs/compta/bank/various_payment/document.php
+++ b/htdocs/compta/bank/various_payment/document.php
@@ -34,7 +34,7 @@ $langs->loadLangs(array("compta", "banks", "bills", "users", "accountancy"));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
@@ -45,7 +45,7 @@ $result = restrictedArea($user, 'banque', '', '', '');
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/cashcontrol/cashcontrol_list.php b/htdocs/compta/cashcontrol/cashcontrol_list.php
index d24c4ac1059..ae2837a35cd 100644
--- a/htdocs/compta/cashcontrol/cashcontrol_list.php
+++ b/htdocs/compta/cashcontrol/cashcontrol_list.php
@@ -64,7 +64,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page;
diff --git a/htdocs/compta/deplacement/card.php b/htdocs/compta/deplacement/card.php
index 4d3ec6b1ee6..682981852d8 100644
--- a/htdocs/compta/deplacement/card.php
+++ b/htdocs/compta/deplacement/card.php
@@ -43,7 +43,7 @@ $id = GETPOST('id', 'int');
if ($user->socid) $socid = $user->socid;
$result = restrictedArea($user, 'deplacement', $id, '');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$object = new Deplacement($db);
diff --git a/htdocs/compta/deplacement/document.php b/htdocs/compta/deplacement/document.php
index 889eb390ca2..98354e328f0 100644
--- a/htdocs/compta/deplacement/document.php
+++ b/htdocs/compta/deplacement/document.php
@@ -39,7 +39,7 @@ $langs->loadLangs(array('other', 'trips', 'companies', 'interventions'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
@@ -50,7 +50,7 @@ $result = restrictedArea($user, 'deplacement', $id, '');
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/facture/admin/facture_cust_extrafields.php b/htdocs/compta/facture/admin/facture_cust_extrafields.php
index 55d4141fc07..df5cb39f9e4 100644
--- a/htdocs/compta/facture/admin/facture_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facture_cust_extrafields.php
@@ -40,7 +40,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facture'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/compta/facture/admin/facture_rec_cust_extrafields.php b/htdocs/compta/facture/admin/facture_rec_cust_extrafields.php
index feeca2046d6..a8d073958ad 100644
--- a/htdocs/compta/facture/admin/facture_rec_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facture_rec_cust_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facture_rec'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/compta/facture/admin/facturedet_cust_extrafields.php b/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
index 87467f0dba6..ebe2a437a92 100644
--- a/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facturedet'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php b/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
index 32a7a8cb75a..a09b0380f59 100644
--- a/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
@@ -41,7 +41,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'facturedet_rec'; //Must be the $table_element of the class that manage extrafield
diff --git a/htdocs/compta/facture/card-rec.php b/htdocs/compta/facture/card-rec.php
index 0074fcc8ba9..284ec8111d5 100644
--- a/htdocs/compta/facture/card-rec.php
+++ b/htdocs/compta/facture/card-rec.php
@@ -190,8 +190,8 @@ if (empty($reshook))
{
$object->titre = GETPOST('titre', 'nohtml'); // deprecated
$object->title = GETPOST('titre', 'nohtml');
- $object->note_private = GETPOST('note_private', 'none');
- $object->note_public = GETPOST('note_public', 'none');
+ $object->note_private = GETPOST('note_private', 'restricthtml');
+ $object->note_public = GETPOST('note_public', 'restricthtml');
$object->model_pdf = GETPOST('modelpdf', 'alpha');
$object->usenewprice = GETPOST('usenewprice', 'alpha');
@@ -405,7 +405,7 @@ if (empty($reshook))
$object->oldcopy = dol_clone($object);
// Fill array 'array_options' with data from update form
- $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'none'));
+ $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'restricthtml'));
if ($ret < 0) $error++;
if (!$error)
@@ -713,7 +713,7 @@ if (empty($reshook))
$date_end = '';
//$date_start = dol_mktime(GETPOST('date_starthour'), GETPOST('date_startmin'), GETPOST('date_startsec'), GETPOST('date_startmonth'), GETPOST('date_startday'), GETPOST('date_startyear'));
//$date_end = dol_mktime(GETPOST('date_endhour'), GETPOST('date_endmin'), GETPOST('date_endsec'), GETPOST('date_endmonth'), GETPOST('date_endday'), GETPOST('date_endyear'));
- $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'none') ? GETPOST('product_desc', 'none') : GETPOST('desc', 'none'));
+ $description = dol_htmlcleanlastbr(GETPOST('product_desc', 'restricthtml') ? GETPOST('product_desc', 'restricthtml') : GETPOST('desc', 'restricthtml'));
$pu_ht = GETPOST('price_ht');
$vat_rate = (GETPOST('tva_tx') ? GETPOST('tva_tx') : 0);
$qty = GETPOST('qty');
@@ -964,8 +964,8 @@ if ($action == 'create')
print ''.$langs->trans("Customer").' '.$object->thirdparty->getNomUrl(1, 'customer').' ';
print ''.$langs->trans('Comments').' ';
print '';
- print ' ';
print '';
diff --git a/htdocs/compta/paiement/card.php b/htdocs/compta/paiement/card.php
index 4acfd34a53a..85f56d298df 100644
--- a/htdocs/compta/paiement/card.php
+++ b/htdocs/compta/paiement/card.php
@@ -39,7 +39,7 @@ $langs->loadLangs(array('bills', 'banks', 'companies'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
@@ -60,7 +60,7 @@ if ($action == 'setnote' && $user->rights->facture->paiement)
$db->begin();
$object->fetch($id);
- $result = $object->update_note(GETPOST('note', 'none'));
+ $result = $object->update_note(GETPOST('note', 'restricthtml'));
if ($result > 0)
{
$db->commit();
diff --git a/htdocs/compta/paiement/cheque/card.php b/htdocs/compta/paiement/cheque/card.php
index aaf216a7558..1691fe3ecfc 100644
--- a/htdocs/compta/paiement/cheque/card.php
+++ b/htdocs/compta/paiement/cheque/card.php
@@ -38,7 +38,7 @@ $langs->loadLangs(array('banks', 'categories', 'bills', 'companies', 'compta'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
@@ -47,7 +47,7 @@ if ($user->socid) $socid = $user->socid;
$result = restrictedArea($user, 'cheque', $id, 'bordereau_cheque', '', 'fk_user_author', $fieldname);
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (!$sortorder) $sortorder = "ASC";
if (!$sortfield) $sortfield = "b.dateo,b.rowid";
diff --git a/htdocs/compta/paiement/info.php b/htdocs/compta/paiement/info.php
index 00c3440b868..68d987b06ff 100644
--- a/htdocs/compta/paiement/info.php
+++ b/htdocs/compta/paiement/info.php
@@ -33,7 +33,7 @@ $langs->loadLangs(array('bills', 'companies'));
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
/*
diff --git a/htdocs/compta/paiement/tovalidate.php b/htdocs/compta/paiement/tovalidate.php
index 349c483a5db..df0b92b5f44 100644
--- a/htdocs/compta/paiement/tovalidate.php
+++ b/htdocs/compta/paiement/tovalidate.php
@@ -41,7 +41,7 @@ if ($user->socid > 0)
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/paiement_charge.php b/htdocs/compta/paiement_charge.php
index 298866a2020..5f442ab0b18 100644
--- a/htdocs/compta/paiement_charge.php
+++ b/htdocs/compta/paiement_charge.php
@@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
$langs->load("bills");
$chid = GETPOST("id", 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$amounts = array();
// Security check
@@ -112,8 +112,8 @@ if ($action == 'add_payment' || ($action == 'confirm_paiement' && $confirm == 'y
$paiement->amounts = $amounts; // Tableau de montant
$paiement->paiementtype = GETPOST("paiementtype", 'alphanohtml');
$paiement->num_payment = GETPOST("num_payment", 'alphanohtml');
- $paiement->note = GETPOST("note", 'none');
- $paiement->note_private = GETPOST("note", 'none');
+ $paiement->note = GETPOST("note", 'restricthtml');
+ $paiement->note_private = GETPOST("note", 'restricthtml');
if (!$error)
{
diff --git a/htdocs/compta/prelevement/bons.php b/htdocs/compta/prelevement/bons.php
index 608c9fe594d..cb702174434 100644
--- a/htdocs/compta/prelevement/bons.php
+++ b/htdocs/compta/prelevement/bons.php
@@ -42,7 +42,7 @@ $type = GETPOST('type', 'aZ09');
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/card.php b/htdocs/compta/prelevement/card.php
index 6349660c59c..a70a464b428 100644
--- a/htdocs/compta/prelevement/card.php
+++ b/htdocs/compta/prelevement/card.php
@@ -37,7 +37,7 @@ $langs->loadLangs(array('banks', 'categories', 'bills', 'companies', 'withdrawal
if ($user->socid > 0) accessforbidden();
// Get supervariables
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$socid = GETPOST('socid', 'int');
@@ -46,7 +46,7 @@ $type = GETPOST('type', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/create.php b/htdocs/compta/prelevement/create.php
index 8642e9ad7ab..8c8dc01a22c 100644
--- a/htdocs/compta/prelevement/create.php
+++ b/htdocs/compta/prelevement/create.php
@@ -46,7 +46,7 @@ $result = restrictedArea($user, 'prelevement', '', '', 'bons');
$type = GETPOST('type', 'aZ09');
// Get supervariables
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$mode = GETPOST('mode', 'alpha') ?GETPOST('mode', 'alpha') : 'real';
$format = GETPOST('format', 'aZ09');
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
diff --git a/htdocs/compta/prelevement/factures.php b/htdocs/compta/prelevement/factures.php
index c4cb6f0c7c4..4104633e111 100644
--- a/htdocs/compta/prelevement/factures.php
+++ b/htdocs/compta/prelevement/factures.php
@@ -46,7 +46,7 @@ $type = GETPOST('type', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/fiche-rejet.php b/htdocs/compta/prelevement/fiche-rejet.php
index 2cfc40bb30c..29d799a8554 100644
--- a/htdocs/compta/prelevement/fiche-rejet.php
+++ b/htdocs/compta/prelevement/fiche-rejet.php
@@ -46,7 +46,7 @@ $type = GETPOST('type', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/fiche-stat.php b/htdocs/compta/prelevement/fiche-stat.php
index c59ed2d4232..3bb71f8c441 100644
--- a/htdocs/compta/prelevement/fiche-stat.php
+++ b/htdocs/compta/prelevement/fiche-stat.php
@@ -44,7 +44,7 @@ $type = GETPOST('type', 'aZ09');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/line.php b/htdocs/compta/prelevement/line.php
index ae146522f39..4120672b44e 100644
--- a/htdocs/compta/prelevement/line.php
+++ b/htdocs/compta/prelevement/line.php
@@ -39,14 +39,14 @@ $langs->loadlangs(array('banks', 'categories', 'bills', 'withdrawals'));
if ($user->socid > 0) accessforbidden();
// Get supervariables
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('id', 'int');
$socid = GETPOST('socid', 'int');
$type = GETPOST('type', 'aZ09');
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$sortfield = GETPOST('sortfield', 'alpha');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if ($page == -1 || $page == null) { $page = 0; }
diff --git a/htdocs/compta/prelevement/list.php b/htdocs/compta/prelevement/list.php
index 2666e8587e6..1255a2b861e 100644
--- a/htdocs/compta/prelevement/list.php
+++ b/htdocs/compta/prelevement/list.php
@@ -51,7 +51,7 @@ $type = GETPOST('type', 'aZ09');
$limit = GETPOST('limit', 'int')?GETPOST('limit', 'int'):$conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/prelevement/rejets.php b/htdocs/compta/prelevement/rejets.php
index a8481d25f7a..6c38e65981b 100644
--- a/htdocs/compta/prelevement/rejets.php
+++ b/htdocs/compta/prelevement/rejets.php
@@ -42,7 +42,7 @@ $type = GETPOST('type', 'aZ09');
// Get supervariables
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$sortfield = GETPOST('sortfield', 'alpha');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
diff --git a/htdocs/compta/recap-compta.php b/htdocs/compta/recap-compta.php
index 8b75ec38fce..3106235430e 100644
--- a/htdocs/compta/recap-compta.php
+++ b/htdocs/compta/recap-compta.php
@@ -47,7 +47,7 @@ $hookmanager->initHooks(array('recapcomptacard', 'globalcard'));
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $limit * $page;
diff --git a/htdocs/compta/sociales/list.php b/htdocs/compta/sociales/list.php
index 40ebcd1cb7c..341799a686a 100644
--- a/htdocs/compta/sociales/list.php
+++ b/htdocs/compta/sociales/list.php
@@ -35,7 +35,7 @@ if (!empty($conf->projet->enabled)) require_once DOL_DOCUMENT_ROOT.'/projet/clas
// Load translation files required by the page
$langs->loadLangs(array('compta', 'banks', 'bills'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
diff --git a/htdocs/compta/tva/card.php b/htdocs/compta/tva/card.php
index 78105cf9585..717b584fe44 100644
--- a/htdocs/compta/tva/card.php
+++ b/htdocs/compta/tva/card.php
@@ -98,7 +98,7 @@ if ($action == 'add' && $_POST["cancel"] <> $langs->trans("Cancel"))
}
$object->amount = $amount;
$object->label = GETPOST("label", 'alpha');
- $object->note = GETPOST("note", 'none');
+ $object->note = GETPOST("note", 'restricthtml');
if (empty($object->datep))
{
diff --git a/htdocs/conf/conf.php.example b/htdocs/conf/conf.php.example
index 32c37301a0e..6b1b5e0ea0a 100644
--- a/htdocs/conf/conf.php.example
+++ b/htdocs/conf/conf.php.example
@@ -219,10 +219,10 @@ $dolibarr_main_authentication='dolibarr';
// 1 = Force redirect to https, until SCRIPT_URI start with https into response
// 2 = Force redirect to https, until SERVER["HTTPS"] is 'on' into response
// 'https://my.domain.com' = Force redirect to https using this domain name.
-// Warning: If you enable this parameter, your web server must be configured to
-// respond URL with https protocol.
-// According to your web server setup, some values may works and other not. Try
-// different values (1,2 or 'https://my.domain.com') if you experience problems.
+// Warning: If you enable this parameter, your web server must be configured to respond URL with https protocol.
+// According to your web server setup, some values may works and other not. Try different values (1,2 or 'https://my.domain.com') if you experience problems.
+// Even if a redirect to HTTPS is forced by the webserver, it is recommanded to set this value to another value than 0, so your session cookies will be
+// flagged as secured.
// Default value: 0
// Possible values: 0, 1, 2 or 'https://my.domain.com'
// Examples:
@@ -233,12 +233,12 @@ $dolibarr_main_force_https='0';
// dolibarr_main_prod
// When this parameter is defined, all errors messages are not reported.
// This feature exists for production usage to avoid to give any information to hackers.
-// Default value: 0
+// Default value: 1
// Possible values: 0 or 1
// Examples:
-// $dolibarr_main_prod='0';
+// $dolibarr_main_prod='1';
//
-$dolibarr_main_prod='0';
+$dolibarr_main_prod='1';
// $dolibarr_main_restrict_os_commands
// To restrict commands you can execute by the backup feature, enter allowed command here.
@@ -260,8 +260,8 @@ $dolibarr_main_restrict_ip='';
// dolibarr_nocsrfcheck
// This parameter can be used to disable CSRF protection.
-// This might be required if you access Dolibarr behind a proxy that make
-// URL rewriting, to avoid false alarms.
+// This might be required if you access Dolibarr behind a proxy that make bad URL rewriting, to avoid false alarms.
+// In most cases, you should always keep this to 0.
// Default value: 0
// Possible values: 0 or 1
// Examples:
@@ -269,6 +269,12 @@ $dolibarr_main_restrict_ip='';
//
$dolibarr_nocsrfcheck='0';
+// dolibarr_cron_allow_cli
+// If set to 1, you will be able to define some command line in the internale Job scheduler module.
+// Default value: '0'
+// Examples: '1'
+$dolibarr_cron_allow_cli='0';
+
// dolibarr_mailing_limit_sendbyweb
// Can set a limit for mailing send by web. This overwrite database value. Can be used to restrict on OS level.
// Default value: '25'
diff --git a/htdocs/contact/agenda.php b/htdocs/contact/agenda.php
index 0ea0018632b..7ac512bd32f 100644
--- a/htdocs/contact/agenda.php
+++ b/htdocs/contact/agenda.php
@@ -83,7 +83,7 @@ $search_agenda_label = GETPOST('search_agenda_label');
// Security check
if ($user->socid) $socid = $user->socid;
-$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', $objcanvas); // If we create a contact with no company (shared contacts), no check on write permission
+$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', 0); // If we create a contact with no company (shared contacts), no check on write permission
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST("sortfield", 'alpha');
diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php
index 6afef016d47..dab7242b598 100644
--- a/htdocs/contact/card.php
+++ b/htdocs/contact/card.php
@@ -78,7 +78,7 @@ if (!empty($canvas))
// Security check
if ($user->socid) $socid = $user->socid;
-$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', $objcanvas); // If we create a contact with no company (shared contacts), no check on write permission
+$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', 0); // If we create a contact with no company (shared contacts), no check on write permission
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
$hookmanager->initHooks(array('contactcard', 'globalcard'));
@@ -207,8 +207,8 @@ if (empty($reshook))
$object->phone_mobile = GETPOST("phone_mobile", 'alpha');
$object->fax = GETPOST("fax", 'alpha');
$object->priv = GETPOST("priv", 'int');
- $object->note_public = GETPOST("note_public", 'none');
- $object->note_private = GETPOST("note_private", 'none');
+ $object->note_public = GETPOST("note_public", 'restricthtml');
+ $object->note_private = GETPOST("note_private", 'restricthtml');
$object->roles = GETPOST("roles", 'array');
$object->statut = 1; //Defult status to Actif
@@ -395,8 +395,8 @@ if (empty($reshook))
$object->phone_mobile = GETPOST("phone_mobile", 'alpha');
$object->fax = GETPOST("fax", 'alpha');
$object->priv = GETPOST("priv", 'int');
- $object->note_public = GETPOST("note_public", 'none');
- $object->note_private = GETPOST("note_private", 'none');
+ $object->note_public = GETPOST("note_public", 'restricthtml');
+ $object->note_private = GETPOST("note_private", 'restricthtml');
$object->roles = GETPOST("roles", 'array');
// Fill array 'array_options' with data from add form
diff --git a/htdocs/contact/document.php b/htdocs/contact/document.php
index e21ee3e492b..f8498ddae9a 100644
--- a/htdocs/contact/document.php
+++ b/htdocs/contact/document.php
@@ -52,7 +52,7 @@ if (!empty($canvas))
// Security check
if ($user->socid) $socid = $user->socid;
-$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', $objcanvas); // If we create a contact with no company (shared contacts), no check on write permission
+$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', 0); // If we create a contact with no company (shared contacts), no check on write permission
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index 03324ed26c4..7bf82aa9379 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -44,7 +44,7 @@ $langs->loadLangs(array("companies", "suppliers", "categories"));
$socialnetworks = getArrayOfSocialNetworks();
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
@@ -105,7 +105,7 @@ $view = GETPOST("view", 'alpha');
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
$userid = GETPOST('userid', 'int');
$begin = GETPOST('begin');
diff --git a/htdocs/contact/perso.php b/htdocs/contact/perso.php
index 724d9077ff1..1710b4dda6a 100644
--- a/htdocs/contact/perso.php
+++ b/htdocs/contact/perso.php
@@ -32,7 +32,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/contact.lib.php';
$langs->loadLangs(array('companies', 'other'));
$id = GETPOST('id', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
// Security check
if ($user->socid) $socid = $user->socid;
diff --git a/htdocs/contrat/admin/contract_extrafields.php b/htdocs/contrat/admin/contract_extrafields.php
index 031a1b7498d..5343ab8f349 100644
--- a/htdocs/contrat/admin/contract_extrafields.php
+++ b/htdocs/contrat/admin/contract_extrafields.php
@@ -42,7 +42,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'contrat'; //Must be the $element of the class that manage extrafield
diff --git a/htdocs/contrat/admin/contractdet_extrafields.php b/htdocs/contrat/admin/contractdet_extrafields.php
index 3e068f5650b..bd0c7b132d0 100644
--- a/htdocs/contrat/admin/contractdet_extrafields.php
+++ b/htdocs/contrat/admin/contractdet_extrafields.php
@@ -42,7 +42,7 @@ $tmptype2label = ExtraFields::$type2label;
$type2label = array('');
foreach ($tmptype2label as $key => $val) $type2label[$key] = $langs->transnoentitiesnoconv($val);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$attrname = GETPOST('attrname', 'alpha');
$elementtype = 'contratdet'; //Must be the $element of the class that manage extrafield
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index cd622b38c28..fadf0831ada 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -50,7 +50,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
// Load translation files required by the page
$langs->loadLangs(array("contracts", "orders", "companies", "bills", "products", 'compta'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$socid = GETPOST('socid', 'int');
$id = GETPOST('id', 'int');
@@ -665,7 +665,7 @@ if (empty($reshook))
$fk_unit = GETPOST('unit', 'alpha');
- $objectline->description = GETPOST('product_desc', 'none');
+ $objectline->description = GETPOST('product_desc', 'restricthtml');
$objectline->price_ht = GETPOST('elprice');
$objectline->subprice = GETPOST('elprice');
$objectline->qty = GETPOST('elqty');
@@ -811,7 +811,7 @@ if (empty($reshook))
$object->oldcopy = dol_clone($object);
// Fill array 'array_options' with data from update form
- $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'none'));
+ $ret = $extrafields->setOptionalsFromPost(null, $object, GETPOST('attribute', 'restricthtml'));
if ($ret < 0) $error++;
if (!$error) {
diff --git a/htdocs/contrat/contact.php b/htdocs/contrat/contact.php
index 02d9c71776d..38a97d0aaa8 100644
--- a/htdocs/contrat/contact.php
+++ b/htdocs/contrat/contact.php
@@ -36,7 +36,7 @@ if (!empty($conf->projet->enabled)) {
// Load translation files required by the page
$langs->loadLangs(array('contracts', 'companies'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$socid = GETPOST('socid', 'int');
$id = GETPOST('id', 'int');
diff --git a/htdocs/contrat/index.php b/htdocs/contrat/index.php
index 40a9a4100da..1293da8cf26 100644
--- a/htdocs/contrat/index.php
+++ b/htdocs/contrat/index.php
@@ -38,7 +38,7 @@ $hookmanager->initHooks(array('contractindex'));
$langs->loadLangs(array('products', 'companies', 'contracts'));
$sortfield = GETPOST('sortfield', 'alpha');
-$sortorder = GETPOST('sortorder', 'alpha');
+$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
$statut = GETPOST('statut') ?GETPOST('statut') : 1;
diff --git a/htdocs/contrat/list.php b/htdocs/contrat/list.php
index 945e6a7d936..608fc6c0d81 100644
--- a/htdocs/contrat/list.php
+++ b/htdocs/contrat/list.php
@@ -39,7 +39,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
// Load translation files required by the page
$langs->loadLangs(array('contracts', 'products', 'companies', 'compta'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$massaction = GETPOST('massaction', 'alpha');
$show_files = GETPOST('show_files', 'int');
$confirm = GETPOST('confirm', 'alpha');
diff --git a/htdocs/contrat/note.php b/htdocs/contrat/note.php
index d782ad5b3f5..d9eb8e3ccdc 100644
--- a/htdocs/contrat/note.php
+++ b/htdocs/contrat/note.php
@@ -34,7 +34,7 @@ if (!empty($conf->projet->enabled)) {
// Load translation files required by the page
$langs->loadLangs(array('companies', 'contracts'));
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$socid = GETPOST('socid', 'int');
$id = GETPOST('id', 'int');
diff --git a/htdocs/core/actions_addupdatedelete.inc.php b/htdocs/core/actions_addupdatedelete.inc.php
index 09f1c7cf314..4d4c12ce473 100644
--- a/htdocs/core/actions_addupdatedelete.inc.php
+++ b/htdocs/core/actions_addupdatedelete.inc.php
@@ -64,7 +64,7 @@ if ($action == 'add' && !empty($permissiontoadd))
// Set value to insert
if (in_array($object->fields[$key]['type'], array('text', 'html'))) {
- $value = GETPOST($key, 'none');
+ $value = GETPOST($key, 'restricthtml');
} elseif ($object->fields[$key]['type'] == 'date') {
$value = dol_mktime(12, 0, 0, GETPOST($key.'month', 'int'), GETPOST($key.'day', 'int'), GETPOST($key.'year', 'int'));
} elseif ($object->fields[$key]['type'] == 'datetime') {
@@ -72,7 +72,7 @@ if ($action == 'add' && !empty($permissiontoadd))
} elseif ($object->fields[$key]['type'] == 'duration') {
$value = 60 * 60 * GETPOST($key.'hour', 'int') + 60 * GETPOST($key.'min', 'int');
} elseif (preg_match('/^(integer|price|real|double)/', $object->fields[$key]['type'])) {
- $value = price2num(GETPOST($key, 'none')); // To fix decimal separator according to lang setup
+ $value = price2num(GETPOST($key, 'alphanohtml')); // To fix decimal separator according to lang setup
} elseif ($object->fields[$key]['type'] == 'boolean') {
$value = (GETPOST($key) == 'on' ? 1 : 0);
} else {
@@ -142,7 +142,7 @@ if ($action == 'update' && !empty($permissiontoadd))
// Set value to update
if (in_array($object->fields[$key]['type'], array('text', 'html'))) {
- $value = GETPOST($key, 'none');
+ $value = GETPOST($key, 'restricthtml');
} elseif ($object->fields[$key]['type'] == 'date') {
$value = dol_mktime(12, 0, 0, GETPOST($key.'month'), GETPOST($key.'day'), GETPOST($key.'year'));
} elseif ($object->fields[$key]['type'] == 'datetime') {
@@ -154,7 +154,7 @@ if ($action == 'update' && !empty($permissiontoadd))
$value = '';
}
} elseif (preg_match('/^(integer|price|real|double)/', $object->fields[$key]['type'])) {
- $value = price2num(GETPOST($key, 'none')); // To fix decimal separator according to lang setup
+ $value = price2num(GETPOST($key, 'alphanohtml')); // To fix decimal separator according to lang setup
} elseif ($object->fields[$key]['type'] == 'boolean') {
$value = ((GETPOST($key, 'aZ09') == 'on' || GETPOST($key, 'aZ09') == '1') ? 1 : 0);
} else {
diff --git a/htdocs/core/actions_changeselectedfields.inc.php b/htdocs/core/actions_changeselectedfields.inc.php
index 9a03ba0d29e..f4e7f01d234 100644
--- a/htdocs/core/actions_changeselectedfields.inc.php
+++ b/htdocs/core/actions_changeselectedfields.inc.php
@@ -28,7 +28,7 @@
// $object must be defined (object is loaded in this file with fetch)
// Save selection
-if (GETPOST('formfilteraction', 'none') == 'listafterchangingselectedfields')
+if (GETPOST('formfilteraction', 'alphanohtml') == 'listafterchangingselectedfields')
{
$tabparam = array();
diff --git a/htdocs/core/actions_comments.inc.php b/htdocs/core/actions_comments.inc.php
index c352f07f9f7..079f207b4a4 100644
--- a/htdocs/core/actions_comments.inc.php
+++ b/htdocs/core/actions_comments.inc.php
@@ -35,7 +35,7 @@ $comment = new Comment($db);
if ($action == 'addcomment')
{
- $description = GETPOST('comment_description', 'none');
+ $description = GETPOST('comment_description', 'restricthtml');
if (!empty($description))
{
$comment->description = $description;
@@ -59,7 +59,7 @@ if ($action === 'updatecomment')
{
if ($comment->fetch($idcomment) >= 0)
{
- $comment->description = GETPOST('comment_description', 'none');
+ $comment->description = GETPOST('comment_description', 'restricthtml');
if ($comment->update($user) > 0)
{
setEventMessages($langs->trans("CommentAdded"), null, 'mesgs');
diff --git a/htdocs/core/actions_linkedfiles.inc.php b/htdocs/core/actions_linkedfiles.inc.php
index 7884fc09e67..3caeeed6678 100644
--- a/htdocs/core/actions_linkedfiles.inc.php
+++ b/htdocs/core/actions_linkedfiles.inc.php
@@ -63,7 +63,7 @@ if (GETPOST('sendit', 'alpha') && !empty($conf->global->MAIN_UPLOAD_DOC))
}
}
}
-} elseif (GETPOST('linkit', 'none') && !empty($conf->global->MAIN_UPLOAD_DOC))
+} elseif (GETPOST('linkit', 'restricthtml') && !empty($conf->global->MAIN_UPLOAD_DOC))
{
$link = GETPOST('link', 'alpha');
if ($link)
diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 612f988305f..4db4c94f007 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -141,7 +141,7 @@ if (!$error && $massaction == 'confirm_presend')
$massaction = 'presend';
}
- if (!GETPOST('subject', 'none'))
+ if (!GETPOST('subject', 'restricthtml'))
{
$error++;
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("MailTopic")), null, 'warnings');
@@ -376,8 +376,8 @@ if (!$error && $massaction == 'confirm_presend')
}
$replyto = $from;
- $subject = GETPOST('subject', 'none');
- $message = GETPOST('message', 'none');
+ $subject = GETPOST('subject', 'restricthtml');
+ $message = GETPOST('message', 'restricthtml');
$sendtobcc = GETPOST('sendtoccc');
if ($objectclass == 'Propal') $sendtobcc .= (empty($conf->global->MAIN_MAIL_AUTOCOPY_PROPOSAL_TO) ? '' : (($sendtobcc ? ", " : "").$conf->global->MAIN_MAIL_AUTOCOPY_PROPOSAL_TO));
diff --git a/htdocs/core/actions_sendmails.inc.php b/htdocs/core/actions_sendmails.inc.php
index da010380276..5be25002079 100644
--- a/htdocs/core/actions_sendmails.inc.php
+++ b/htdocs/core/actions_sendmails.inc.php
@@ -300,8 +300,8 @@ if (($action == 'send' || $action == 'relance') && !$_POST['addfile'] && !$_POST
}
$replyto = dol_string_nospecial($_POST['replytoname'], ' ', array(",")).' <'.$_POST['replytomail'].'>';
- $message = GETPOST('message', 'none');
- $subject = GETPOST('subject', 'none');
+ $message = GETPOST('message', 'restricthtml');
+ $subject = GETPOST('subject', 'restricthtml');
// Make a change into HTML code to allow to include images from medias directory with an external reabable URL.
//
+ * Copyright (C) 2020 Laurent Destailleur
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -27,11 +27,15 @@ if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1');
require '../../main.inc.php';
-$id = GETPOST('id', 'int');
-$action = GETPOST('action', 'alpha');
+$id = GETPOST('id', 'int'); // id of thirdparty
+$action = GETPOST('action', 'aZ09');
$htmlname = GETPOST('htmlname', 'alpha');
$showempty = GETPOST('showempty', 'int');
+// Security check
+$result = restrictedArea($user, 'societe', $id, '&societe', '', 'fk_soc', 'rowid', 0);
+
+
/*
* View
*/
diff --git a/htdocs/core/ajax/objectonoff.php b/htdocs/core/ajax/objectonoff.php
index 6c9f97bfbb0..ceb221b4870 100644
--- a/htdocs/core/ajax/objectonoff.php
+++ b/htdocs/core/ajax/objectonoff.php
@@ -30,7 +30,7 @@ if (!defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1');
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/genericobject.class.php';
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('id', 'int');
$value = GETPOST('value', 'int');
$field = GETPOST('field', 'alpha');
diff --git a/htdocs/core/ajax/pingresult.php b/htdocs/core/ajax/pingresult.php
index e08b2c5efcf..e58895a967f 100644
--- a/htdocs/core/ajax/pingresult.php
+++ b/htdocs/core/ajax/pingresult.php
@@ -30,7 +30,7 @@ if (!defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1');
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$hash_unique_id = GETPOST('hash_unique_id', 'alpha');
$hash_algo = GETPOST('hash_algo', 'alpha');
diff --git a/htdocs/core/ajax/selectobject.php b/htdocs/core/ajax/selectobject.php
index eed6c21c126..a672510555b 100644
--- a/htdocs/core/ajax/selectobject.php
+++ b/htdocs/core/ajax/selectobject.php
@@ -33,7 +33,7 @@ $objectdesc = GETPOST('objectdesc', 'alpha');
$htmlname = GETPOST('htmlname', 'aZ09');
$sqlfilter = GETPOST('sqlfilter', 'alpha');
$outjson = (GETPOST('outjson', 'int') ? GETPOST('outjson', 'int') : 0);
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$id = GETPOST('id', 'int');
diff --git a/htdocs/core/ajax/selectsearchbox.php b/htdocs/core/ajax/selectsearchbox.php
index 00b66ced374..29aeb9cc7eb 100644
--- a/htdocs/core/ajax/selectsearchbox.php
+++ b/htdocs/core/ajax/selectsearchbox.php
@@ -48,7 +48,7 @@ include_once DOL_DOCUMENT_ROOT.'/core/lib/json.lib.php';
//global $hookmanager;
$hookmanager->initHooks(array('searchform'));
-$search_boxvalue = GETPOST('q', 'none');
+$search_boxvalue = GETPOST('q', 'restricthtml');
$arrayresult = array();
diff --git a/htdocs/core/ajax/vatrates.php b/htdocs/core/ajax/vatrates.php
index b0ab6ed2a7e..0bd16eb6449 100644
--- a/htdocs/core/ajax/vatrates.php
+++ b/htdocs/core/ajax/vatrates.php
@@ -27,7 +27,7 @@ if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1');
require '../../main.inc.php';
$id = GETPOST('id', 'int');
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$htmlname = GETPOST('htmlname', 'alpha');
$selected = (GETPOST('selected') ?GETPOST('selected') : '-1');
$productid = (GETPOST('productid', 'int') ?GETPOST('productid', 'int') : 0);
diff --git a/htdocs/core/boxes/modules_boxes.php b/htdocs/core/boxes/modules_boxes.php
index e5fa9d8fb0d..51719ec6c15 100644
--- a/htdocs/core/boxes/modules_boxes.php
+++ b/htdocs/core/boxes/modules_boxes.php
@@ -422,6 +422,7 @@ class ModeleBoxes // Can't be abtract as it is instantiated to build "empty" box
{
while (($file = readdir($handle)) !== false)
{
+ $reg = array();
if (is_readable($newdir.'/'.$file) && preg_match('/^(.+)\.php/', $file, $reg))
{
if (preg_match('/\.back$/', $file)) continue;
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index a381014983b..ef519f388a7 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -6690,7 +6690,9 @@ abstract class CommonObject
break;
case "create":
case "edit":
- $getposttemp = GETPOST($keyprefix.'options_'.$key.$keysuffix, 'none'); // GETPOST can get value from GET, POST or setup of default values.
+ $check = 'restricthtml';
+ // TODO Use check = 'alphahtml' or 'int' for some types
+ $getposttemp = GETPOST($keyprefix.'options_'.$key.$keysuffix, $check); // GETPOST can get value from GET, POST or setup of default values.
// GETPOST("options_" . $key) can be 'abc' or array(0=>'abc')
if (is_array($getposttemp) || $getposttemp != '' || GETPOSTISSET($keyprefix.'options_'.$key.$keysuffix))
{
@@ -6765,7 +6767,7 @@ abstract class CommonObject
// HTML, select, integer and text add default value
if (in_array($extrafields->attributes[$this->table_element]['type'][$key], array('html', 'text', 'select', 'int')))
{
- if ($action == 'create') $value = GETPOSTISSET($keyprefix.'options_'.$key.$keysuffix) ? GETPOST($keyprefix.'options_'.$key.$keysuffix, 'none', 3) : $extrafields->attributes[$this->table_element]['default'][$key];
+ if ($action == 'create') $value = GETPOSTISSET($keyprefix.'options_'.$key.$keysuffix) ? GETPOST($keyprefix.'options_'.$key.$keysuffix, 'restricthtml', 3) : $extrafields->attributes[$this->table_element]['default'][$key];
else $value = $this->array_options['options_'.$key];
}
@@ -6775,7 +6777,7 @@ abstract class CommonObject
$out .= ' 
diff --git a/htdocs/core/actions_setnotes.inc.php b/htdocs/core/actions_setnotes.inc.php
index 7ea3dd5016f..61db9b9fc55 100644
--- a/htdocs/core/actions_setnotes.inc.php
+++ b/htdocs/core/actions_setnotes.inc.php
@@ -33,7 +33,7 @@ if ($action == 'setnote_public' && !empty($permissionnote) && !GETPOST('cancel',
if (empty($action) || !is_object($object) || empty($id)) dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
if (empty($object->id)) $object->fetch($id); // Fetch may not be already done
- $result_update = $object->update_note(dol_html_entity_decode(GETPOST('note_public', 'none'), ENT_QUOTES, 'UTF-8', 1), '_public');
+ $result_update = $object->update_note(dol_html_entity_decode(GETPOST('note_public', 'restricthtml'), ENT_QUOTES, 'UTF-8', 1), '_public');
if ($result_update < 0) setEventMessages($object->error, $object->errors, 'errors');
elseif (in_array($object->table_element, array('supplier_proposal', 'propal', 'commande_fournisseur', 'commande', 'facture_fourn', 'facture')))
@@ -63,6 +63,6 @@ if ($action == 'setnote_public' && !empty($permissionnote) && !GETPOST('cancel',
// Set public note
if (empty($action) || !is_object($object) || empty($id)) dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
if (empty($object->id)) $object->fetch($id); // Fetch may not be already done
- $result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'none'), ENT_QUOTES), '_private');
+ $result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'restricthtml'), ENT_QUOTES), '_private');
if ($result < 0) setEventMessages($object->error, $object->errors, 'errors');
}
diff --git a/htdocs/core/ajax/constantonoff.php b/htdocs/core/ajax/constantonoff.php
index 1ed8ca34076..456542e331e 100644
--- a/htdocs/core/ajax/constantonoff.php
+++ b/htdocs/core/ajax/constantonoff.php
@@ -30,7 +30,7 @@ if (!defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1');
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
-$action = GETPOST('action', 'alpha');
+$action = GETPOST('action', 'aZ09');
$name = GETPOST('name', 'alpha');
/*
diff --git a/htdocs/core/ajax/contacts.php b/htdocs/core/ajax/contacts.php
index 67e769ab17f..6b476a8f59a 100644
--- a/htdocs/core/ajax/contacts.php
+++ b/htdocs/core/ajax/contacts.php
@@ -1,6 +1,6 @@
- * Copyright (C) 2016 Laurent Destailleur