From 94e76ab91ff5725d316999af1b14616cedfe70e6 Mon Sep 17 00:00:00 2001
From: ldestailleur <eldy@destailleur.fr>
Date: Sun, 28 Sep 2025 14:38:24 +0200
Subject: [PATCH 1/6] css

---
 htdocs/core/tpl/admin_extrafields_add.tpl.php  | 2 +-
 htdocs/core/tpl/admin_extrafields_edit.tpl.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/tpl/admin_extrafields_add.tpl.php b/htdocs/core/tpl/admin_extrafields_add.tpl.php
index 97eb229fd60..47ca36254b5 100644
--- a/htdocs/core/tpl/admin_extrafields_add.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_add.tpl.php
@@ -201,7 +201,7 @@ print $formadmin->selectTypeOfFields('type', GETPOST('type', 'alpha'));
 <td>
 	<table class="nobordernopadding">
 	<tr><td>
-		<textarea name="param" id="param" cols="80" rows="<?php echo ROWS_4 ?>"><?php echo GETPOST('param', 'alpha'); ?></textarea>
+		<textarea name="param" id="param" cols="80" rows="<?php echo ROWS_4 ?>" spellcheck="false""><?php echo GETPOST('param', 'alpha'); ?></textarea>
 	</td><td>
 	<span id="helpselect" class="spanforparamtooltip"><?php print $form->textwithpicto('', $langs->trans("ExtrafieldParamHelpselect"), 1, 'info', '', 0, 2, 'helpvalue1')?></span>
 	<span id="helpsellist" class="spanforparamtooltip"><?php print $form->textwithpicto('', $langs->trans("ExtrafieldParamHelpsellist").'<br>'.$langs->trans("ExtrafieldParamHelpsellistb").'<br>'.$langs->trans("ExtrafieldParamHelpsellistc").'<br>'.$langs->trans("ExtrafieldParamHelpsellistd").(getDolGlobalInt('MAIN_FEATUREES_LEVEL') > 0 ? '<br>'.$langs->trans("ExtrafieldParamHelpsellist2") : ''), 1, 'info', '', 0, 2, 'helpvalue2')?></span>
diff --git a/htdocs/core/tpl/admin_extrafields_edit.tpl.php b/htdocs/core/tpl/admin_extrafields_edit.tpl.php
index 88049c436a7..f29d14b0bfb 100644
--- a/htdocs/core/tpl/admin_extrafields_edit.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_edit.tpl.php
@@ -263,7 +263,7 @@ if (in_array($type, array_keys($typewecanchangeinto))) {
 <td>
 	<table class="nobordernopadding">
 	<tr><td>
-		<textarea name="param" id="param" cols="80" rows="<?php echo ROWS_4 ?>"><?php echo dol_htmlcleanlastbr($param_chain); ?></textarea>
+		<textarea name="param" id="param" cols="80" rows="<?php echo ROWS_4 ?>" spellcheck="false"><?php echo dol_htmlcleanlastbr($param_chain); ?></textarea>
 	</td><td>
 	<span id="helpselect" class="spanforparamtooltip"><?php print $form->textwithpicto('', $langs->trans("ExtrafieldParamHelpselect"), 1, 'info', '', 0, 2, 'helpvalue1')?></span>
 	<span id="helpsellist" class="spanforparamtooltip"><?php print $form->textwithpicto('', $langs->trans("ExtrafieldParamHelpsellist").'<br>'.$langs->trans("ExtrafieldParamHelpsellistb").'<br>'.$langs->trans("ExtrafieldParamHelpsellistc").'<br>'.$langs->trans("ExtrafieldParamHelpsellistd").(getDolGlobalInt('MAIN_FEATUREES_LEVEL') > 0 ? '<br>'.$langs->trans("ExtrafieldParamHelpsellist2") : ''), 1, 'info', '', 0, 2, 'helpvalue2')?></span>

From 752e06f5fcd6175edbeda130302b54836fab1781 Mon Sep 17 00:00:00 2001
From: ldestailleur <eldy@destailleur.fr>
Date: Sun, 28 Sep 2025 15:20:46 +0200
Subject: [PATCH 2/6] FIX #35520 FIX #35522

---
 htdocs/core/class/extrafields.class.php       | 21 +++++++++++++------
 htdocs/core/db/DoliDB.class.php               | 17 +++++++++++++--
 .../tpl/extrafields_list_search_input.tpl.php | 11 +++++++---
 3 files changed, 38 insertions(+), 11 deletions(-)

diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index 8510bd5dd52..03984db4e5e 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -1111,14 +1111,14 @@ class ExtraFields
 	 * Code very similar with showInputField of common object
 	 *
 	 * @param  string        		$key            		Key of attribute
-	 * @param  string|array{start:int,end:int}  $value 			    Preselected value to show (for date type it must be in timestamp format, for amount or price it must be a php numeric value); for dates in filter mode, a range array('start'=><timestamp>, 'end'=><timestamp>) should be provided
+	 * @param  string|array{start:int,end:int}  $value 		Preselected value to show (for date type it must be in timestamp format, for amount or price it must be a php numeric value); for dates in filter mode, a range array('start'=><timestamp>, 'end'=><timestamp>) should be provided
 	 * @param  string        		$moreparam      		To add more parameters on html input tag
 	 * @param  string        		$keysuffix      		Suffix string to add after name and id of field (can be used to avoid duplicate names)
 	 * @param  string        		$keyprefix      		Prefix string to add before name and id of field (can be used to avoid duplicate names)
 	 * @param  string        		$morecss        		More css (to defined size of field. Old behaviour: may also be a numeric)
 	 * @param  int|CommonObject     $object       			Current object or object ID. Preferably, pass the object itself.
 	 * @param  string        		$extrafieldsobjectkey	The key to use to store retrieved data (commonly $object->table_element)
-	 * @param  int	         		$mode                  1=Used for search filters
+	 * @param  int	         		$mode                  	1=Used for search filters
 	 * @return string
 	 */
 	public function showInputField($key, $value, $moreparam = '', $keysuffix = '', $keyprefix = '', $morecss = '', $object = 0, $extrafieldsobjectkey = '', $mode = 0)
@@ -1430,6 +1430,7 @@ class ExtraFields
 				}
 			}
 			if (!getDolGlobalString('MAIN_EXTRAFIELDS_ENABLE_NEW_SELECT2')) {
+				//$out .= '<!-- type = sellist -->';
 				$out .= '<select class="flat '.$morecss.' maxwidthonsmartphone" name="'.$keyprefix.$key.$keysuffix.'" id="'.$keyprefix.$key.$keysuffix.'" '.($moreparam ? $moreparam : '').'>';
 				if (is_array($param['options'])) {
 					// WARNING!! @FIXME This code is duplicated into core/class/extrafields.class.php
@@ -1609,16 +1610,22 @@ class ExtraFields
 								$labeltoshow = '';
 								$obj = $this->db->fetch_object($resql);
 
-								// Several field into label (eq table:code|label:rowid)
+								$nameFields = $InfoFieldList[1];
+								// If text is "field1|f(a,b,c) as xxx|field2", we must convert string into 'field1|xxx|field2'
+								$nameFields = preg_replace('/[a-z_]+\([^\)]*\) as ([\w]+)/i', '\1', $nameFields);
+								// Sanitize field names to avoid sql injection
+								$nameFields = preg_replace('/[^0-9a-z_\.\|]/i', '', $nameFields);
+
+								// Several fields into label (eq table:code|label:rowid)
 								$notrans = false;
-								$fields_label = explode('|', $InfoFieldList[1]);
+								$fields_label = explode('|', $nameFields);
 								if (is_array($fields_label) && count($fields_label) > 1) {
 									$notrans = true;
 									foreach ($fields_label as $field_toshow) {
 										$labeltoshow .= $obj->$field_toshow.' ';
 									}
 								} else {
-									$labeltoshow = $obj->{$InfoFieldList[1]};
+									$labeltoshow = $obj->$nameFields;
 								}
 
 								if ($value == $obj->rowid) {
@@ -1631,7 +1638,7 @@ class ExtraFields
 									$out .= '<option value="'.$obj->rowid.'" selected>'.$labeltoshow.'</option>';
 								} else {
 									if (!$notrans) {
-										$translabel = $langs->trans($obj->{$InfoFieldList[1]});
+										$translabel = $langs->trans($obj->$nameFields);
 										$labeltoshow = $translabel;
 									}
 									if (empty($labeltoshow)) {
@@ -1639,6 +1646,8 @@ class ExtraFields
 									}
 
 									if (!empty($InfoFieldList[3]) && $parentField) {
+										// Sanitize parent field name to avoid sql injection
+										$parentField = preg_replace('/[^a-zA-Z0-9_\-]/', '', $parentField);
 										$parent = $parentName.':'.$obj->{$parentField};
 									}
 
diff --git a/htdocs/core/db/DoliDB.class.php b/htdocs/core/db/DoliDB.class.php
index 824e85a5e4d..5eedbb4e39a 100644
--- a/htdocs/core/db/DoliDB.class.php
+++ b/htdocs/core/db/DoliDB.class.php
@@ -322,7 +322,7 @@ abstract class DoliDB implements Database
 	/**
 	 * Define sort criteria of request
 	 *
-	 * @param	string		$sortfield		List of sort fields, separated by comma. Example: 't1.fielda,t2.fieldb'
+	 * @param	string		$sortfield		List of sort fields, separated by comma. Example: 't1.fielda,t2.fieldb' or 't1.fielda,concat(a,b,c) as abc,t2.fieldb'
 	 * @param	string		$sortorder		Sort order, separated by comma. Example: 'ASC,DESC'. Note: If the quantity for sortorder values is lower than sortfield, we used the last value for missing values.
 	 * @return	string						String to provide syntax of a sort sql string
 	 */
@@ -331,17 +331,30 @@ abstract class DoliDB implements Database
 		if (!empty($sortfield)) {
 			$oldsortorder = '';
 			$return = '';
+
+			// If text is "field1, f(a,b,c) as xxx, field2", we must convert string into 'field1,xxx,field2'
+			$sortfield = preg_replace('/[a-z_]+\([^\)]*\) as ([\w]+)/i', '\1', $sortfield);
+
 			$fields = explode(',', $sortfield);
 			$orders = (!empty($sortorder) ? explode(',', $sortorder) : array());
 			$i = 0;
+
+
 			foreach ($fields as $val) {
+				// Sanitized fieldname
+				$fieldname = preg_replace('/[^0-9a-z_\.]/i', '', $val);
+				if (!$fieldname) {
+					continue;
+				}
+
 				if (!$return) {
 					$return .= ' ORDER BY ';
 				} else {
 					$return .= ', ';
 				}
 
-				$return .= preg_replace('/[^0-9a-z_\.]/i', '', $val); // Add field
+				// Add field
+				$return .= $fieldname;
 
 				$tmpsortorder = (empty($orders[$i]) ? '' : trim($orders[$i]));
 
diff --git a/htdocs/core/tpl/extrafields_list_search_input.tpl.php b/htdocs/core/tpl/extrafields_list_search_input.tpl.php
index c7c6b2ec789..f70b0ea89d1 100644
--- a/htdocs/core/tpl/extrafields_list_search_input.tpl.php
+++ b/htdocs/core/tpl/extrafields_list_search_input.tpl.php
@@ -1,5 +1,4 @@
 <?php
-
 /* Copyright (C) 2025		Frédéric France			<frederic.france@free.fr>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -14,13 +13,19 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <https://www.gnu.org/licenses/>.
- *
  */
 
 /**
  * @var Conf $conf
- * @var DoliDB $db
  * @var CommonObject $object
+ * @var DoliDB $db
+ * @var ExtraFields $extrafields
+ *
+ * @var array<string,mixed> $arrayfields
+ * @var ?string $extrafieldsobjectkey
+ * @var	?string $extrafieldsobjectprefix
+ * @var ?string $search_options_pattern
+ * @var array<string,mixed> $search_array_options
  */
 
 print '<!-- extrafields_list_search_input.tpl.php -->'."\n";

From 67e185a30fc7e25324e2f1cb99090e600d9b941e Mon Sep 17 00:00:00 2001
From: ldestailleur <eldy@destailleur.fr>
Date: Sun, 28 Sep 2025 15:33:56 +0200
Subject: [PATCH 3/6] Better tooltip

---
 htdocs/langs/en_US/admin.lang | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index 591b78f7fde..008d5fa6121 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -484,7 +484,7 @@ ExtrafieldParamHelpPassword=Leaving this field blank means this value will be st
 ExtrafieldParamHelpselect=List of values must be lines with format key,value (where key can't be '0')<br><br> for example: <br>1,value1<br>2,value2<br>code3,value3<br>...<br><br>In order to have the list depending on another complementary attribute list:<br>1,value1|options_<i>parent_list_code</i>:parent_key<br>2,value2|options_<i>parent_list_code</i>:parent_key <br><br>In order to have the list depending on another list:<br>1,value1|<i>parent_list_code</i>:parent_key<br>2,value2|<i>parent_list_code</i>:parent_key
 ExtrafieldParamHelpcheckbox=List of values must be lines with format key,value (where key can't be '0')<br><br> for example: <br>1,value1<br>2,value2<br>3,value3<br>...
 ExtrafieldParamHelpradio=List of values must be lines with format key,value (where key can't be '0')<br><br> for example: <br>1,value1<br>2,value2<br>3,value3<br>...
-ExtrafieldParamHelpsellist=List of values coming from a table<br><br>Syntax: table_name:label_field:id_field::filtersql<br>Example: c_typent:libelle:id::filtersql<br><br>- id_field is necessarily a primary int key<br>- filtersql is a condition. It must use the USF syntax. Example: (active:=:1) to display only active value
+ExtrafieldParamHelpsellist=List of values coming from a table<br><br>Syntax: table_name:label_field:id_field::filtersql<br>Example: c_typent:libelle:id::filtersql<br><br>- label_field is the name of the field in database, or can be several fiels separated by |<br>- id_field is necessarily a primary int key<br>- filtersql is a condition. It must use the USF syntax. Example: (active:=:1) to display only active value
 ExtrafieldParamHelpsellistb=In USF syntax, use the name of fields in database table or extra.fieldname to use the field in the extrafield table.
 ExtrafieldParamHelpsellistc=You can also use $ID$ in filter which is the current ID of current object or more generally, use $property$ to get the value of the property of the current edited object.
 ExtrafieldParamHelpsellistd=Use the string __NOW__ or __USER_ID__ to get the current date or current user ID.

From 33dbb293ea5daa6f8fc07535c2dfa3291a5b5181 Mon Sep 17 00:00:00 2001
From: ldestailleur <eldy@destailleur.fr>
Date: Sun, 28 Sep 2025 15:39:37 +0200
Subject: [PATCH 4/6] Fix comment

---
 htdocs/core/class/extrafields.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index 03984db4e5e..30ec049d7aa 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -1613,7 +1613,7 @@ class ExtraFields
 								$nameFields = $InfoFieldList[1];
 								// If text is "field1|f(a,b,c) as xxx|field2", we must convert string into 'field1|xxx|field2'
 								$nameFields = preg_replace('/[a-z_]+\([^\)]*\) as ([\w]+)/i', '\1', $nameFields);
-								// Sanitize field names to avoid sql injection
+								// Sanitize field names to avoid error when doing $obj->field
 								$nameFields = preg_replace('/[^0-9a-z_\.\|]/i', '', $nameFields);
 
 								// Several fields into label (eq table:code|label:rowid)
@@ -1646,7 +1646,7 @@ class ExtraFields
 									}
 
 									if (!empty($InfoFieldList[3]) && $parentField) {
-										// Sanitize parent field name to avoid sql injection
+										// Sanitize parent field name to avoid when doing $obj->field
 										$parentField = preg_replace('/[^a-zA-Z0-9_\-]/', '', $parentField);
 										$parent = $parentName.':'.$obj->{$parentField};
 									}

From 83ae0eedab640c09036a26c83e023f7762e2c9e3 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@users.sourceforge.net>
Date: Sun, 28 Sep 2025 18:37:40 +0200
Subject: [PATCH 5/6] Code comment

---
 htdocs/core/js/lib_head.js.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/htdocs/core/js/lib_head.js.php b/htdocs/core/js/lib_head.js.php
index 2e63484deef..61ae4a59aec 100644
--- a/htdocs/core/js/lib_head.js.php
+++ b/htdocs/core/js/lib_head.js.php
@@ -568,6 +568,7 @@ function cleanSerialize(expr) {
  * Input:   message
  * Author:  Regis Houssin
  * Licence: GPL
+ * TODO To remove, seems not used
  * ==================================================================
  */
 function displayMessage(fieldId,message) {
@@ -586,6 +587,7 @@ function displayMessage(fieldId,message) {
  * Input:   message
  * Author:  Regis Houssin
  * Licence: GPL
+ * TODO To remove, seems not used
  * ==================================================================
  */
 function hideMessage(fieldId,message) {

From 8db1c3eec2a5c1d7b27138d3c658bd281eeb8c69 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@users.sourceforge.net>
Date: Sun, 28 Sep 2025 18:42:49 +0200
Subject: [PATCH 6/6] Code comment

---
 htdocs/admin/modules.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php
index 95917d208ab..8d5761e1b73 100644
--- a/htdocs/admin/modules.php
+++ b/htdocs/admin/modules.php
@@ -1126,6 +1126,7 @@ if ($mode == 'common' || $mode == 'commonkanban') {
 				$codeenabledisable .= '<!-- Message to show: '.$warningmessage.' -->'."\n";
 				$codeenabledisable .= '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$objMod->numero.'&token='.newToken().'&module_position='.$module_position.'&action=set&token='.newToken().'&value='.$modName.'&mode='.$mode.$param.'"';
 				if ($warningmessage) {
+					// TODO Use a nicer popup
 					$codeenabledisable .= ' onclick="return confirm(\''.dol_escape_js($warningmessage).'\');"';
 				}
 				$codeenabledisable .= '>';