diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php
index 80b41148ba6..3a698c6b042 100644
--- a/htdocs/adherents/class/adherent.class.php
+++ b/htdocs/adherents/class/adherent.class.php
@@ -325,6 +325,8 @@ class Adherent extends CommonObject
// Substitutions
$substitutionarray=array(
+ '__ID__'=>$this->id,
+ '__MEMBER_ID__'=>$this->id,
'__CIVILITY__'=>$this->getCivilityLabel(),
'__FIRSTNAME__'=>$msgishtml?dol_htmlentitiesbr($this->firstname):($this->firstname?$this->firstname:''),
'__LASTNAME__'=>$msgishtml?dol_htmlentitiesbr($this->lastname):($this->lastname?$this->lastname:''),
diff --git a/htdocs/adherents/subscription.php b/htdocs/adherents/subscription.php
index 58f3cbb2caf..b28998ec39e 100644
--- a/htdocs/adherents/subscription.php
+++ b/htdocs/adherents/subscription.php
@@ -348,7 +348,7 @@ if ($user->rights->adherent->cotisation->creer && $action == 'subscription' && !
if (! $error)
{
// Send confirmation Email
- if ($object->email && $sendalsoemail)
+ if ($object->email && $sendalsoemail) // $object is 'Adherent'
{
$subject = '';
$msg= '';
diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php
index 7e59fa333bb..fc3b8f15f39 100644
--- a/htdocs/admin/dict.php
+++ b/htdocs/admin/dict.php
@@ -793,7 +793,7 @@ if (GETPOST('actionadd') || GETPOST('actionmodify'))
else $sql.="'".$db->escape($_POST[$listfieldvalue[$i]])."'";
$i++;
}
- $sql.= " WHERE ".$rowidcol." = '".$rowid."'";
+ $sql.= " WHERE ".$rowidcol." = '".$db->escape($rowid)."'";
if (in_array('entity', $listfieldmodify)) $sql.= " AND entity = '".getEntity($tabname[$id])."'";
dol_syslog("actionmodify", LOG_DEBUG);
@@ -817,7 +817,7 @@ if ($action == 'confirm_delete' && $confirm == 'yes') // delete
if ($tabrowid[$id]) { $rowidcol=$tabrowid[$id]; }
else { $rowidcol="rowid"; }
- $sql = "DELETE FROM ".$tabname[$id]." WHERE ".$rowidcol."='".$rowid."'".($entity != '' ? " AND entity = " . (int) $entity : '');
+ $sql = "DELETE FROM ".$tabname[$id]." WHERE ".$rowidcol."='".$db->escape($rowid)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
dol_syslog("delete", LOG_DEBUG);
$result = $db->query($sql);
@@ -841,7 +841,7 @@ if ($action == $acts[0])
else { $rowidcol="rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET active = 1 WHERE ".$rowidcol."='".$rowid."'".($entity != '' ? " AND entity = " . (int) $entity : '');
+ $sql = "UPDATE ".$tabname[$id]." SET active = 1 WHERE ".$rowidcol."='".$db->escape($rowid)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
}
elseif ($code) {
$sql = "UPDATE ".$tabname[$id]." SET active = 1 WHERE code='".dol_escape_htmltag($code)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
@@ -861,7 +861,7 @@ if ($action == $acts[1])
else { $rowidcol="rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET active = 0 WHERE ".$rowidcol."='".$rowid."'".($entity != '' ? " AND entity = " . (int) $entity : '');
+ $sql = "UPDATE ".$tabname[$id]." SET active = 0 WHERE ".$rowidcol."='".$db->escape($rowid)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
}
elseif ($code) {
$sql = "UPDATE ".$tabname[$id]." SET active = 0 WHERE code='".dol_escape_htmltag($code)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
@@ -881,7 +881,7 @@ if ($action == 'activate_favorite')
else { $rowidcol="rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET favorite = 1 WHERE ".$rowidcol."='".$rowid."'".($entity != '' ? " AND entity = " . (int) $entity : '');
+ $sql = "UPDATE ".$tabname[$id]." SET favorite = 1 WHERE ".$rowidcol."='".$db->escape($rowid)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
}
elseif ($code) {
$sql = "UPDATE ".$tabname[$id]." SET favorite = 1 WHERE code='".dol_escape_htmltag($code)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
@@ -901,7 +901,7 @@ if ($action == 'disable_favorite')
else { $rowidcol="rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET favorite = 0 WHERE ".$rowidcol."='".$rowid."'".($entity != '' ? " AND entity = " . (int) $entity : '');
+ $sql = "UPDATE ".$tabname[$id]." SET favorite = 0 WHERE ".$rowidcol."='".$db->escape($rowid)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
}
elseif ($code) {
$sql = "UPDATE ".$tabname[$id]." SET favorite = 0 WHERE code='".dol_escape_htmltag($code)."'".($entity != '' ? " AND entity = " . (int) $entity : '');
@@ -966,7 +966,7 @@ if (GETPOST('from')) $paramwithsearch.= '&from='.urlencode(GETPOST('from','alpha
// Confirmation de la suppression de la ligne
if ($action == 'delete')
{
- print $form->formconfirm($_SERVER["PHP_SELF"].'?'.($page?'page='.$page.'&':'').'rowid='.$rowid.'&code='.urlencode($code).$paramwithsearch, $langs->trans('DeleteLine'), $langs->trans('ConfirmDeleteLine'), 'confirm_delete','',0,1);
+ print $form->formconfirm($_SERVER["PHP_SELF"].'?'.($page?'page='.$page.'&':'').'rowid='.urlencode($rowid).'&code='.urlencode($code).$paramwithsearch, $langs->trans('DeleteLine'), $langs->trans('ConfirmDeleteLine'), 'confirm_delete','',0,1);
}
//var_dump($elementList);
@@ -1373,8 +1373,8 @@ if ($id)
print '| ';
print '';
- print '';
- print '';
+ print '';
+ print '';
if (! is_null($withentity))
print '';
print '';
@@ -1628,14 +1628,14 @@ if ($id)
if ($id == 4)
{
print ' | ';
- if ($iserasable) print ''.$actl[$obj->favorite].'';
+ if ($iserasable) print ''.$actl[$obj->favorite].'';
else print $langs->trans("AlwaysActive");
print ' | ';
}
// Active
print '';
- if ($canbedisabled) print ''.$actl[$obj->active].'';
+ if ($canbedisabled) print ''.$actl[$obj->active].'';
else
{
if (in_array($obj->code, array('AC_OTH','AC_OTH_AUTO'))) print $langs->trans("AlwaysActive");
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index 61dba965b50..4e4d1266416 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -1698,7 +1698,7 @@ if (empty($reshook))
setEventMessages($langs->trans('ErrorFieldRequired', $langs->transnoentitiesnoconv('Type')), null, 'errors');
$error++;
}
- if ($prod_entry_mode == 'free' && empty($idprod) && (($price_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES)) || $price_ht == '') && $price_ht_devise == '') // Unit price can be 0 but not ''
+ if (($prod_entry_mode == 'free' && empty($idprod) && (($price_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES)) || $price_ht == '') && $price_ht_devise == '') && $object->type != Facture::TYPE_CREDIT_NOTE) // Unit price can be 0 but not ''
{
if ($price_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES))
{
@@ -2160,7 +2160,7 @@ if (empty($reshook))
setEventMessages($langs->trans('ErrorQtyForCustomerInvoiceCantBeNegative'), null, 'errors');
$error++;
}
- if (empty($productid) && (($pu_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES)) || $pu_ht == '') && $pu_ht_devise == '') // Unit price can be 0 but not ''
+ if ((empty($productid) && (($pu_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES)) || $pu_ht == '') && $pu_ht_devise == '') && $object->type != Facture::TYPE_CREDIT_NOTE) // Unit price can be 0 but not ''
{
if ($pu_ht < 0 && empty($conf->global->FACTURE_ENABLE_NEGATIVE_LINES))
{
diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 4dc58ccf212..630c67e9979 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -542,7 +542,9 @@ if ($massaction == 'confirm_createbills')
$objecttmp = new Facture($db);
if (!empty($createbills_onebythird) && !empty($TFactThird[$cmd->socid])) $objecttmp = $TFactThird[$cmd->socid]; // If option "one bill per third" is set, we use already created order.
else {
-
+ // Load extrafields of order
+ $cmd->fetch_optionals();
+
$objecttmp->socid = $cmd->socid;
$objecttmp->type = Facture::TYPE_STANDARD;
$objecttmp->cond_reglement_id = $cmd->cond_reglement_id;
@@ -559,6 +561,8 @@ if ($massaction == 'confirm_createbills')
$objecttmp->origin = 'commande';
$objecttmp->origin_id = $id_order;
+ $objecttmp->array_options = $cmd->array_options; // Copy extrafields
+
$res = $objecttmp->create($user);
if($res > 0) $nb_bills_created++;
@@ -708,6 +712,7 @@ if ($massaction == 'confirm_createbills')
if (! $error && $validate_invoices)
{
$massaction = $action = 'builddoc';
+
foreach($TAllFact as &$objecttmp)
{
$result = $objecttmp->validate($user);
@@ -725,7 +730,12 @@ if ($massaction == 'confirm_createbills')
$donotredirect = 1;
$upload_dir = $conf->facture->dir_output;
$permissioncreate=$user->rights->facture->creer;
+
+ // Call action to build doc
+ $savobject = $object;
+ $object = $objecttmp;
include DOL_DOCUMENT_ROOT.'/core/actions_builddoc.inc.php';
+ $object = $savobject;
}
$massaction = $action = 'confirm_createbills';
diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index 508cd1c159e..c95ad9afe82 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -483,9 +483,9 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
{
$sql.= ",".MAIN_DB_PREFIX."usergroup_user as ug";
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
- $sql.= " AND (ug.fk_user = dbt.rowid";
- $sql.= " AND ug.entity IN (".getEntity('user')."))";
- $sql.= " OR dbt.entity = 0"; // Show always superadmin
+ $sql.= " AND ((ug.fk_user = dbt.rowid";
+ $sql.= " AND ug.entity IN (".getEntity('usergroup')."))";
+ $sql.= " OR dbt.entity = 0)"; // Show always superadmin
}
}
else {
diff --git a/htdocs/install/inc.php b/htdocs/install/inc.php
index c1581d37392..54b34b89e8c 100644
--- a/htdocs/install/inc.php
+++ b/htdocs/install/inc.php
@@ -196,7 +196,7 @@ if (constant('DOL_DATA_ROOT') === null) {
}
if (@file_exists($lockfile))
{
- if (! is_object($langs))
+ if (! isset($langs) || ! is_object($langs))
{
$langs = new Translate('..', $conf);
$langs->setDefaultLang('auto');
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index 26e2f8c7d40..8db719c62d4 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -86,9 +86,11 @@ $socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
-if (!$canreaduser) {
+
+if (! $canreaduser) {
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}
+
if ($user->id <> $id && ! $canreaduser) accessforbidden();
// Load translation files required by page
|