Merge branch '5.0' of git@github.com:Dolibarr/dolibarr.git into develop

Conflicts: dev/skeletons/build_class_from_table.php dev/skeletons/skeleton_card.php htdocs/compta/facture/class/facture.class.php htdocs/core/lib/functions.lib.php htdocs/filefunc.inc.php htdocs/projet/card.php
2025-12-09 19:18:22 +01:00 · 2017-06-03 01:55:05 +02:00
parent b789246e8d 3555bd2bd7
commit 7f18dfee0d
14 changed files with 187 additions and 151 deletions
--- a/20
+++ b/20
@@ -22,6 +22,26 @@ Following changes may create regression for some external modules, but were nece
 * Removed the trigger file of PAYPAL module that stored data that was not used by Dolibarr. The trigger event still
  exists, but if an external module need action on it, it must provides itself its trigger file.

+***** ChangeLog for 5.0.3 compared to 5.0.2 *****
+FIX: #6677 Expired contracts dashboard box does not show the name of the thirdparty
+FIX: #6813
+FIX: 6863
+FIX: #6877
+FIX: #6881
+FIX: Better sanitizing of search all parameter.
+FIX: Correction with author and validator user on orders
+FIX: dialog window with md theme must not be hidden by left menu part.
+FIX: doactions hook missing in invoice model page
+FIX: Fullname when member is a moral entity with no name.
+FIX: Link to files on bank account tab broken with multicompany FIX: Link to preview on thirdparty broken with multicompany
+FIX: New vat code not correctly implemented if "1 price per customer".
+FIX: Pagination of invoices
+FIX: pagination on resources
+FIX: REST API not possible to add agendaevents
+FIX: situation invoice broken due to the all percent application form inside addline form
+FIX: SQL injection on user/index.php parameter search_statut.
+FIX: XSS
+
 ***** ChangeLog for 5.0.2 compared to 5.0.1 *****
 FIX: #6468 + Fix missing translation
 FIX: #6517 #6525 Autocompletion of thirdparty after n chars not implemented
--- a/build/debian/source/lintian-overrides
+++ b/build/debian/source/lintian-overrides
@@ -4,7 +4,12 @@ dolibarr: source-contains-prebuilt-javascript-object htdocs/includes/jsgantt/*
 dolibarr: source-contains-prebuilt-javascript-object htdocs/includes/jstz/*
 # Those are false positives, the files are their own sources since
 # they are not minified
-source-is-missing htdocs/includes/jsgantt/jsgantt.js *
-source-is-missing htdocs/includes/jquery/plugins/colorpicker/jquery.colorpicker.js *
-source-is-missing htdocs/includes/jquery/plugins/select2/select2.js *
-source-is-missing htdocs/includes/jquery/plugins/select2/select2_locale_ar.js *
+source-is-missing htdocs/includes/ckeditor/ckeditor/plugins/a11yhelp/dialogs/lang/*.js
+source-is-missing htdocs/includes/ckeditor/ckeditor/plugins/specialchar/dialogs/lang/*.js
+source-is-missing htdocs/includes/ckeditor/ckeditor/lang/*.js
+source-is-missing htdocs/includes/ckeditor/ckeditor/plugins/*/dialogs/*.js
+source-is-missing htdocs/includes/ckeditor/ckeditor/plugins/*/filter/*.js
+source-is-missing htdocs/includes/ckeditor/ckeditor/plugins/templates/templates/default.js
+source-is-missing htdocs/includes/mobiledetect/mobiledetectlib/Mobile_Detect.json
+source-is-missing htdocs/includes/restler/framework/Luracast/Restler/explorer/lib/*.js
+
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1208,7 +1208,7 @@ if ($id > 0)
 		$out.=img_picto($langs->trans("ViewCal"),'object_calendar','class="hideonsmartphone pictoactionview"');
 		$out.='<a href="'.DOL_URL_ROOT.'/comm/action/index.php?action=show_month&year='.dol_print_date($object->datep,'%Y').'&month='.dol_print_date($object->datep,'%m').'&day='.dol_print_date($object->datep,'%d').'">'.$langs->trans("ViewCal").'</a>';
 		$out.=img_picto($langs->trans("ViewWeek"),'object_calendarweek','class="hideonsmartphone pictoactionview"');
-		$out.='<a href="'.DOL_URL_ROOT.'/comm/action/index.php?action=show_day&year='.dol_print_date($object->datep,'%Y').'&month='.dol_print_date($object->datep,'%m').'&day='.dol_print_date($object->datep,'%d').'">'.$langs->trans("ViewWeek").'</a>';
+		$out.='<a href="'.DOL_URL_ROOT.'/comm/action/index.php?action=show_week&year='.dol_print_date($object->datep,'%Y').'&month='.dol_print_date($object->datep,'%m').'&day='.dol_print_date($object->datep,'%d').'">'.$langs->trans("ViewWeek").'</a>';
 		$out.=img_picto($langs->trans("ViewDay"),'object_calendarday','class="hideonsmartphone pictoactionview"');
 		$out.='<a href="'.DOL_URL_ROOT.'/comm/action/index.php?action=show_day&year='.dol_print_date($object->datep,'%Y').'&month='.dol_print_date($object->datep,'%m').'&day='.dol_print_date($object->datep,'%d').'">'.$langs->trans("ViewDay").'</a>';
 		$linkback.=$out;
--- a/htdocs/compta/facture/class/facture.class.php
+++ b/htdocs/compta/facture/class/facture.class.php
@@ -361,6 +361,7 @@ class Facture extends CommonInvoice
 			    '__INVOICE_NEXT_YEAR__' => dol_print_date(dol_time_plus_duree($this->date, 1, 'y'), '%Y'),
 			);

+			$substitutionisok=true;
 			complete_substitutions_array($substitutionarray, $outputlangs);

 			$this->note_public=make_substitutions($this->note_public,$substitutionarray);
@@ -2650,7 +2651,7 @@ class Facture extends CommonInvoice
 	 * 	@param		double		$pu_ht_devise		Unit price in currency
 	 *  @return    	int             				< 0 if KO, > 0 if OK
 	 */
-	function updateline($rowid, $desc, $pu, $qty, $remise_percent, $date_start, $date_end, $txtva, $txlocaltax1=0, $txlocaltax2=0, $price_base_type='HT', $info_bits=0, $type= self::TYPE_STANDARD, $fk_parent_line=0, $skip_update_total=0, $fk_fournprice=null, $pa_ht=0, $label='', $special_code=0, $array_options=0, $situation_percent=0, $fk_unit = null, $pu_ht_devise = 0)
+	function updateline($rowid, $desc, $pu, $qty, $remise_percent, $date_start, $date_end, $txtva, $txlocaltax1=0, $txlocaltax2=0, $price_base_type='HT', $info_bits=0, $type= self::TYPE_STANDARD, $fk_parent_line=0, $skip_update_total=0, $fk_fournprice=null, $pa_ht=0, $label='', $special_code=0, $array_options=0, $situation_percent=100, $fk_unit = null, $pu_ht_devise = 0)
 	{
 		global $conf,$user;
 		// Deprecation warning
--- a/htdocs/compta/prelevement/class/bonprelevement.class.php
+++ b/htdocs/compta/prelevement/class/bonprelevement.class.php
@@ -1272,16 +1272,6 @@ class BonPrelevement extends CommonObject
 			 * section Debiteur (sepa Debiteurs bloc lines)
 			 */

-			/*$tmp_invoices = array();
-
-			$sql = "SELECT f.facnumber as fac FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl, ".MAIN_DB_PREFIX."facture as f, ".MAIN_DB_PREFIX."prelevement_facture as pf, ".MAIN_DB_PREFIX."societe as soc, ".MAIN_DB_PREFIX."c_country as p, ".MAIN_DB_PREFIX."societe_rib as rib WHERE pl.fk_prelevement_bons = ".$this->id." AND pl.rowid = pf.fk_prelevement_lignes AND pf.fk_facture = f.rowid AND soc.fk_pays = p.rowid AND soc.rowid = f.fk_soc AND rib.fk_soc = f.fk_soc AND rib.default_rib = 1";
-			$resql=$this->db->query($sql);
-			if ($resql) {
-				while ($objfac = $this->db->fetch_object($resql)) {
-					$tmp_invoices[] = $objfac->fac;
-				}
-			}*/
-
 			$sql = "SELECT soc.code_client as code, soc.address, soc.zip, soc.town, c.code as country_code,";
 			$sql.= " pl.client_nom as nom, pl.code_banque as cb, pl.code_guichet as cg, pl.number as cc, pl.amount as somme,";
 			$sql.= " f.facnumber as fac, pf.fk_facture as idfac, rib.datec, rib.iban_prefix as iban, rib.bic as bic, rib.rowid as drum";
@@ -1365,35 +1355,6 @@ class BonPrelevement extends CommonObject
 			fputs($this->file, '		</PmtInf>'.$CrLf);
 			fputs($this->file, '	</CstmrDrctDbtInitn>'.$CrLf);
 			fputs($this->file, '</Document>'.$CrLf);
-
-			/*$sql = "SELECT pl.amount";
-			$sql.= " FROM";
-			$sql.= " ".MAIN_DB_PREFIX."prelevement_lignes as pl,";
-			$sql.= " ".MAIN_DB_PREFIX."facture as f,";
-			$sql.= " ".MAIN_DB_PREFIX."prelevement_facture as pf";
-			$sql.= " WHERE pl.fk_prelevement_bons = ".$this->id;
-			$sql.= " AND pl.rowid = pf.fk_prelevement_lignes";
-			$sql.= " AND pf.fk_facture = f.rowid";
-
-			//Lines
-			$i = 0;
-			$resql=$this->db->query($sql);
-			if ($resql)
-			{
-				$num = $this->db->num_rows($resql);
-
-				while ($i < $num)
-				{
-					$obj = $this->db->fetch_object($resql);
-					$this->total = $this->total + $obj->amount;
-					$i++;
-				}
-			}
-			else
-			{
-				$result = -2;
-			}*/
-
        }

        // Build file for Other Countries with unknow format
@@ -1580,11 +1541,11 @@ class BonPrelevement extends CommonObject
 		$XML_DEBITOR .='					</FinInstnId>'.$CrLf;
 		$XML_DEBITOR .='				</DbtrAgt>'.$CrLf;
 		$XML_DEBITOR .='				<Dbtr>'.$CrLf;
-		$XML_DEBITOR .='					<Nm>'.strtoupper(dol_string_unaccent($row_nom)).'</Nm>'.$CrLf;
+		$XML_DEBITOR .='					<Nm>'.dolEscapeXML(strtoupper(dol_string_unaccent($row_nom))).'</Nm>'.$CrLf;
 		$XML_DEBITOR .='					<PstlAdr>'.$CrLf;
 		$XML_DEBITOR .='						<Ctry>'.$row_country_code.'</Ctry>'.$CrLf;
-		$XML_DEBITOR .='						<AdrLine>'.dol_string_unaccent(strtr($row_address, array(CHR(13) => ", ", CHR(10) => ""))).'</AdrLine>'.$CrLf;
-		$XML_DEBITOR .='						<AdrLine>'.dol_string_unaccent($row_zip.' '.$row_town).'</AdrLine>'.$CrLf;
+		$XML_DEBITOR .='						<AdrLine>'.dolEscapeXML(dol_trunc(dol_string_unaccent(strtr($row_address, array(CHR(13) => ", ", CHR(10) => ""))),70,'right','UTF-8',true)).'</AdrLine>'.$CrLf;
+		$XML_DEBITOR .='						<AdrLine>'.dolEscapeXML(dol_string_unaccent($row_zip.' '.$row_town)).'</AdrLine>'.$CrLf;
 		$XML_DEBITOR .='					</PstlAdr>'.$CrLf;
 		$XML_DEBITOR .='				</Dbtr>'.$CrLf;
 		$XML_DEBITOR .='				<DbtrAcct>'.$CrLf;
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -2749,6 +2749,8 @@ class ContratLigne extends CommonObjectLine
 		if (empty($this->total_ht)) $this->total_ht = 0;
 		if (empty($this->total_tva)) $this->total_tva = 0;
 		if (empty($this->total_ttc)) $this->total_ttc = 0;
+		if (empty($this->localtax1_tx)) $this->localtax1_tx = 0;
+		if (empty($this->localtax2_tx)) $this->localtax2_tx = 0;

 		// Check parameters
 		// Put here code to add control on parameters values
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -1588,7 +1588,8 @@ function dol_print_date($time,$format='',$tzoutput='tzserver',$outputlangs='',$e
 	if (preg_match('/__b__/i',$format))
 	{
 		// Here ret is string in PHP setup language (strftime was used). Now we convert to $outputlangs.
-		$month=adodb_strftime('%m',$time+$offsettz+$offsetdst);					// TODO Remove this
+		$month=adodb_strftime('%m',$time+$offsettz+$offsetdst);					// TODO Replace this with function Date PHP. We also should not use anymore offsettz and offsetdst but only offsettzstring.
+        $month=sprintf("%02d", $month);                             // $month may be return with format '06' on some installation and '6' on other, so we force it to '06'.
 		if ($encodetooutput)
 		{
 			$monthtext=$outputlangs->transnoentities('Month'.$month);
@@ -2795,7 +2796,7 @@ function img_printer($titlealt = "default", $other='')
 }

 /**
- *  Show delete logo
+ *  Show split logo
 *
 *  @param	string	$titlealt   Text on alt and title of image. Alt only if param notitle is set to 1. If text is "TextA:TextB", use Text A on alt and Text B on title.
 *	@param  string	$other      Add more attributes on img
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -345,7 +345,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 * This function is also called by restrictedArea
 *
 * @param User		$user			User to check
- * @param array		$featuresarray	Features/modules to check. Example: ('user','service')
+ * @param array		$featuresarray	Features/modules to check. Example: ('user','service','member','project','task',...)
 * @param int		$objectid		Object ID if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
 * @param string	$tableandshare	'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity for multicompany modume. Param not used if objectid is null (optional).
 * @param string	$feature2		Feature to check, second level of permission (optional). Can be or check with 'level1|level2'.
@@ -369,11 +369,14 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh

 		// For backward compatibility
 		if ($feature == 'member') $feature='adherent';
+		if ($feature == 'project') $feature='projet';
+		if ($feature == 'task') $feature='projet_task';

 		$check = array('adherent','banque','user','usergroup','produit','service','produit|service','categorie'); // Test on entity only (Objects with no link to company)
 		$checksoc = array('societe');	 // Test for societe object
 		$checkother = array('contact');	 // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...).
-		$checkproject = array('projet'); // Test for project object
+		$checkproject = array('projet','project'); // Test for project object
+		$checktask = array('projet_task');
 		$nocheck = array('barcode','stock','fournisseur');	// No test
 		$checkdefault = 'all other not already defined'; // Test on entity and link to third party. Not allowed if link is empty (Ex: invoice, orders...).

@@ -453,7 +456,7 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
 		}
 		else if (in_array($feature,$checkproject))
 		{
-			if (! empty($conf->projet->enabled) && ! $user->rights->projet->all->lire)
+			if (! empty($conf->projet->enabled) && empty($user->rights->projet->all->lire))
 			{
 				include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
 				$projectstatic=new Project($db);
@@ -469,6 +472,27 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
 				$sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
 			}
 		}
+		else if (in_array($feature,$checktask))
+		{
+			if (! empty($conf->projet->enabled) && empty($user->rights->projet->all->lire))
+			{
+			    $task = new Task($db);
+			    $task->fetch($objectid);
+
+				include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
+				$projectstatic=new Project($db);
+				$tmps=$projectstatic->getProjectsAuthorizedForUser($user,0,1,0);
+				$tmparray=explode(',',$tmps);
+				if (! in_array($task->fk_project,$tmparray)) return false;
+			}
+			else
+			{
+				$sql = "SELECT dbt.".$dbt_select;
+				$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
+				$sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
+				$sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
+			}
+		}
 		else if (! in_array($feature,$nocheck))	// By default we check with link to third party
 		{
 			// If external user: Check permission for external users
--- a/htdocs/filefunc.inc.php
+++ b/htdocs/filefunc.inc.php
@@ -31,7 +31,7 @@
 */

 if (! defined('DOL_APPLICATION_TITLE')) define('DOL_APPLICATION_TITLE','Dolibarr');
-if (! defined('DOL_VERSION')) define('DOL_VERSION','6.0.0-alpha');		// a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c
+if (! defined('DOL_VERSION')) define('DOL_VERSION','6.0.0-beta');		// a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c

 if (! defined('EURO')) define('EURO',chr(128));

--- a/htdocs/install/upgrade2.php
+++ b/htdocs/install/upgrade2.php
@@ -3945,7 +3945,10 @@ function migrate_delete_old_files($db,$langs,$conf)

    DOL_DOCUMENT_ROOT.'/compta/facture/class/api_invoice.class.php',
    DOL_DOCUMENT_ROOT.'/commande/class/api_commande.class.php',
-    DOL_DOCUMENT_ROOT.'/user/class/api_user.class.php'
+    DOL_DOCUMENT_ROOT.'/user/class/api_user.class.php',
+    DOL_DOCUMENT_ROOT.'/product/class/api_product.class.php',
+    DOL_DOCUMENT_ROOT.'/societe/class/api_contact.class.php',
+    DOL_DOCUMENT_ROOT.'/societe/class/api_thirdparty.class.php'
    );

    foreach ($filetodeletearray as $filetodelete)
--- a/htdocs/projet/card.php
+++ b/htdocs/projet/card.php
@@ -958,6 +958,7 @@ elseif ($object->id > 0)
    // Change probability from status
    if (! empty($conf->use_javascript_ajax) && ! empty($conf->global->PROJECT_USE_OPPORTUNITIES))
    {
+        // Default value to close or not when we set opp to 'WON'.
        $defaultcheckedwhenoppclose=1;
        if (empty($conf->global->PROJECT_HIDE_TASKS)) $defaultcheckedwhenoppclose=0;

@@ -973,12 +974,16 @@ elseif ($object->id > 0)
                    var oldpercent = \''.dol_escape_js($object->opp_percent).'\';

                    console.log("We select "+elemcode);
-                    if (elemcode == \'LOST\') defaultcloseproject = 1;
-                    jQuery("#divtocloseproject").show();
-                    if (defaultcloseproject) jQuery("#inputcloseproject").prop("checked", true);
+
+                    /* Define if checkbox to close is checked or not */
+                    var closeproject = 0;
+                    if (elemcode == \'LOST\') closeproject = 1;
+                    if (elemcode == \'WON\') closeproject = defaultcloseproject;
+                    if (closeproject) jQuery("#inputcloseproject").prop("checked", true);
                    else jQuery("#inputcloseproject").prop("checked", false);

-                    /* Make close project visible or not */
+                    /* Make the close project checkbox visible or not */
+                    console.log("closeproject="+closeproject);
                    if (elemcode == \'WON\' || elemcode == \'LOST\')
                    {
                        jQuery("#divtocloseproject").show();
--- a/htdocs/projet/class/api_projects.class.php
+++ b/htdocs/projet/class/api_projects.class.php
@@ -538,6 +538,9 @@ class Projects extends DolibarrApi

        $object = parent::_cleanObjectDatas($object);

+        unset($object->titre);
+        unset($object->datec);
+        unset($object->datem);
        unset($object->barcode_type);
        unset($object->barcode_type_code);
        unset($object->barcode_type_label);
--- a/htdocs/supplier_proposal/class/supplier_proposal.class.php
+++ b/htdocs/supplier_proposal/class/supplier_proposal.class.php
@@ -356,11 +356,13 @@ class SupplierProposal extends CommonObject
     *      @param		array		$array_option		extrafields array
 	 * 		@param		string		$ref_fourn			Supplier price reference
 	 * 		@param		int			$fk_unit			Id of the unit to use.
+	 * 		@param		string		$origin				'order', 'supplier_proposal', ...
+	 * 		@param		int			$origin_id			Id of origin line
     *    	@return    	int         	    			>0 if OK, <0 if KO
     *
     *    	@see       	add_product
     */
-	function addline($desc, $pu_ht, $qty, $txtva, $txlocaltax1=0, $txlocaltax2=0, $fk_product=0, $remise_percent=0, $price_base_type='HT', $pu_ttc=0, $info_bits=0, $type=0, $rang=-1, $special_code=0, $fk_parent_line=0, $fk_fournprice=0, $pa_ht=0, $label='',$array_option=0, $ref_fourn='', $fk_unit='')
+    function addline($desc, $pu_ht, $qty, $txtva, $txlocaltax1=0, $txlocaltax2=0, $fk_product=0, $remise_percent=0, $price_base_type='HT', $pu_ttc=0, $info_bits=0, $type=0, $rang=-1, $special_code=0, $fk_parent_line=0, $fk_fournprice=0, $pa_ht=0, $label='',$array_option=0, $ref_fourn='', $fk_unit='', $origin='', $origin_id=0)
    {
    	global $mysoc;

@@ -462,7 +464,8 @@ class SupplierProposal extends CommonObject
            $this->line->special_code=$special_code;
            $this->line->fk_parent_line=$fk_parent_line;
            $this->line->fk_unit=$fk_unit;
-
+            $this->line->origin=$origin;
+            $this->line->origin_id=$origin_id;
 			$this->line->ref_fourn = $this->db->escape($ref_fourn);

 			// infos marge
@@ -880,7 +883,10 @@ class SupplierProposal extends CommonObject
 							$this->lines[$i]->pa_ht,
 							$this->lines[$i]->label,
 							$this->lines[$i]->array_options,
-							$this->lines[$i]->ref_fourn
+							$this->lines[$i]->ref_fourn,
+							$this->lines[$i]->fk_unit,
+							'supplier_proposal',
+							$this->lines[$i]->rowid
 						);

                        if ($result < 0)
--- a/test/phpunit/DateLibTest.php
+++ b/test/phpunit/DateLibTest.php
@@ -335,6 +335,11 @@ class DateLibTest extends PHPUnit_Framework_TestCase
    	print __METHOD__." result=".$result."\n";
    	$this->assertEquals('02/01/1970 00:00',$result);

+    	// Check %a and %b format for fr_FR
+    	$result=dol_print_date(0,'%a %b %B',true,$outputlangs);
+    	print __METHOD__." result=".$result."\n";
+    	$this->assertEquals('Jeu Jan. Janvier',$result);
+
    	// Check day format for en_US
    	$outputlangs=new Translate('',$conf);
    	$outputlangs->setDefaultLang('en_US');
@@ -345,9 +350,9 @@ class DateLibTest extends PHPUnit_Framework_TestCase
    	$this->assertEquals('01/02/1970',$result);

    	// Check %a and %b format for en_US
-    	$result=dol_print_date(0,'%a %b',true,$outputlangs);
+    	$result=dol_print_date(0,'%a %b %B',true,$outputlangs);
    	print __METHOD__." result=".$result."\n";
-    	$this->assertEquals('Thu Jan',$result);
+    	$this->assertEquals('Thu Jan January',$result);

    	return $result;
    }