diff --git a/SECURITY.md b/SECURITY.md
index 427b1cc7ae2..9c28e2874b9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,8 +12,7 @@ This file contains some policies about the security reports on Dolibarr ERP CRM
## Reporting a Vulnerability
-To report a vulnerability, please use GitHub security advisory at https://github.com/Dolibarr/dolibarr/security/advisories/new (if you have permissions) or alternatively send an email to security@dolibarr.org (for everybody)
-
+To report a vulnerability, please use GitHub security advisory at [https://github.com/Dolibarr/dolibarr/security/advisories/new](https://github.com/Dolibarr/dolibarr/security/advisories/new) (if you have permissions) or alternatively send an email to security@dolibarr.org (for everybody)
## Hunting vulnerabilities on Dolibarr
@@ -23,7 +22,7 @@ If you believe you've found a security bug in our service, we are happy to work
Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and Dolibarr infrastructure.
-We recommand to install Dolibarr ERP CRM on your own server (as most Open Source software, download and use is free: https://www.dolibarr.org/download) to get access on every side of application.
+We recommand to install Dolibarr ERP CRM on your own server (as most Open Source software, download and use is free: [https://www.dolibarr.org/download](https://www.dolibarr.org/download)) to get access on every side of application.
### User Agent
@@ -31,8 +30,7 @@ If you try to find bug on Dolibarr, we recommend to append to your user-agent he
### Account access
-You can install the web application yourself on your own platform/server so you get full access to application and sources. Download the zip of the files to put into your own web server virtual host from https://www.dolibarr.org/download
-
+You can install the web application yourself on your own platform/server so you get full access to application and sources. Download the zip of the files to put into your own web server virtual host from [https://www.dolibarr.org/download](https://www.dolibarr.org/download)
## Eligibility and Responsible Disclosure
@@ -46,7 +44,6 @@ You must avoid tests that could cause degradation or interruption of our service
You must not leak, manipulate, or destroy any user data of third parties to find your vulnerability.
-
## Scope for qualified vulnerabilities
ONLY vulnerabilities discovered, when the following setup on test platform is used, are "valid":
@@ -64,7 +61,6 @@ ONLY vulnerabilities discovered, when the following setup on test platform is us
Scope is the web application (back office) and the APIs.
-
## Qualifying vulnerabilities for reporting
* Remote code execution (RCE)
@@ -81,7 +77,6 @@ Scope is the web application (back office) and the APIs.
* Software version disclosure (for non admin users only)
* Stack traces or path disclosure (for non admin users only)
-
## Non-qualifying vulnerabilities for reporting
* "Self" XSS
@@ -99,4 +94,3 @@ Scope is the web application (back office) and the APIs.
* Software version or private IP disclosure when logged user is admin
* Stack traces or path disclosure when logged user is admin
* Any vulnerabilities due to a configuration different than the one defined into chapter "Scope for qualified vulnerabilities".
-
diff --git a/htdocs/accountancy/class/accountingaccount.class.php b/htdocs/accountancy/class/accountingaccount.class.php
index 50116b94b23..f3e70ac837a 100644
--- a/htdocs/accountancy/class/accountingaccount.class.php
+++ b/htdocs/accountancy/class/accountingaccount.class.php
@@ -732,17 +732,16 @@ class AccountingAccount extends CommonObject
/**
* Return Suggest accounting accounts to bind
*
- * @param Societe $buyer Societe Object Buyers
- * @param $seller Company Object seller
- * @param Product $product Product object sell or buy
- * @param Facture $facture Facture
- * @param FactureLigne $factureDet Facture Det
- * @param array $accountingAccount array of Account account
- * @param string $type Customer / Supplier
- *
- * @return array Accounting accounts suggested
+ * @param Societe $buyer Object buyer
+ * @param Societe $seller Object seller
+ * @param Product $product Product object sell or buy
+ * @param Facture $facture Facture
+ * @param FactureLigne $factureDet Facture Det
+ * @param array $accountingAccount Array of Account account
+ * @param string $type Customer / Supplier
+ * @return array Accounting accounts suggested
*/
- public function getAccountingCodeToBind(Societe $buyer, $seller, Product $product, Facture $facture, FactureLigne $factureDet, $accountingAccount = array(), $type = '')
+ public function getAccountingCodeToBind(Societe $buyer, Societe $seller, Product $product, Facture $facture, FactureLigne $factureDet, $accountingAccount = array(), $type = '')
{
global $conf;
global $hookmanager;
@@ -755,21 +754,21 @@ class AccountingAccount extends CommonObject
$reshook = $hookmanager->executeHooks('accoutancyBindingCalculation', $parameters); // Note that $action and $object may have been modified by some hooks
if (empty($reshook)) {
- if ($type=='customer') {
+ if ($type == 'customer') {
$const_name = "SOLD";
- } elseif ($type=='supplier') {
+ } elseif ($type == 'supplier') {
$const_name = "BUY";
}
require_once DOL_DOCUMENT_ROOT . '/core/lib/company.lib.php';
$isBuyerInEEC = isInEEC($buyer);
$isSellerInEEC = isInEEC($seller);
- $code_l = '';
- $code_p = '';
- $code_t = '';
+ $code_l = ''; // Default value for generic product/service
+ $code_p = ''; // Value for the product/service in parameter ($product)
+ $code_t = ''; // Default value of product account for the thirdparty
$suggestedid = '';
- // Level 1: Search suggested default account for product/service
+ // Level 1 (define $code_l): Search suggested default account for product/service
$suggestedaccountingaccountbydefaultfor = '';
if ($factureDet->product_type == 1) {
if ($buyer->country_code == $seller->country_code || empty($buyer->country_code)) { // If buyer in same country than seller (if not defined, we assume it is same country)
@@ -814,7 +813,7 @@ class AccountingAccount extends CommonObject
$code_l = '';
}
- // Level 2: Search suggested account for product/service (similar code exists in page index.php to make automatic binding)
+ // Level 2 (define $code_p): Search suggested account for product/service (similar code exists in page index.php to make automatic binding)
$suggestedaccountingaccountfor = '';
if ((($buyer->country_code == $seller->country_code) || empty($buyer->country_code))) {
// If buyer in same country than seller (if not defined, we assume it is same country)
@@ -866,7 +865,7 @@ class AccountingAccount extends CommonObject
}
}
- // Level 3: Search suggested account for this thirdparty (similar code exists in page index.php to make automatic binding)
+ // Level 3 (define $code_t): Search suggested account for this thirdparty (similar code exists in page index.php to make automatic binding)
if (!empty($conf->global->ACCOUNTANCY_USE_PRODUCT_ACCOUNT_ON_THIRDPARTY)) {
if (!empty($buyer->code_compta)) {
$code_t = $buyer->code_compta;
@@ -888,6 +887,7 @@ class AccountingAccount extends CommonObject
$suggestedaccountingaccountfor = 'deposit';
}
+ // If $suggestedid could not be guessed yet, we set it from the generic default accounting code $code_l
if (empty($suggestedid) && empty($code_p) && !empty($code_l) && empty($conf->global->ACCOUNTANCY_DO_NOT_AUTOFILL_ACCOUNT_WITH_GENERIC)) {
if (empty($this->accountingaccount_codetotid_cache[$code_l])) {
$tmpaccount = new self($this->db);
diff --git a/htdocs/accountancy/customer/list.php b/htdocs/accountancy/customer/list.php
index c07f4854b84..ab1ac678262 100644
--- a/htdocs/accountancy/customer/list.php
+++ b/htdocs/accountancy/customer/list.php
@@ -478,7 +478,6 @@ if ($result) {
print '';
print '';
print '
';
- //print '
';
print '
';
print '
';
print '
';
@@ -528,6 +527,9 @@ if ($result) {
while ($i < min($num_lines, $limit)) {
$objp = $db->fetch_object($result);
+ // product_type: 0 = service, 1 = product
+ // if product does not exist we use the value of product_type provided in facturedet to define if this is a product or service
+ // issue : if we change product_type value in product DB it should differ from the value stored in facturedet DB !
$code_sell_l = '';
$code_sell_p = '';
@@ -586,9 +588,9 @@ if ($result) {
$suggestedid=$return['suggestedid'];
$suggestedaccountingaccountfor=$return['suggestedaccountingaccountfor'];
$suggestedaccountingaccountbydefaultfor=$return['suggestedaccountingaccountbydefaultfor'];
- $code_sell_l=$return['code_sell_l'];
- $code_sell_p=$return['code_sell_p'];
- $code_sell_t=$return['code_sell_t'];
+ $code_sell_l=$return['code_l'];
+ $code_sell_p=$return['code_p'];
+ $code_sell_t=$return['code_t'];
}
//var_dump($return);
@@ -661,11 +663,11 @@ if ($result) {
print '';
// Vat rate
- $code_vat_differ='';
- if ($product_static->tva_tx !== $facture_static_det->tva_tx && ! empty($facture_static_det->tva_tx)) { // Note: having a vat rate of 0 is often the normal case when sells is intra b2b or to export
- $code_vat_differ = 'font-weight:bold; text-decoration:blink; color:red';
+ $code_vat_differ = '';
+ if ($product_static->tva_tx !== $facture_static_det->tva_tx && price2num($product_static->tva_tx) && price2num($facture_static_det->tva_tx)) { // Note: having a vat rate of 0 is often the normal case when sells is intra b2b or to export
+ $code_vat_differ = 'warning bold';
}
- print '
';
print '';
diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php
index b7e914c381a..a189727494c 100644
--- a/htdocs/accountancy/supplier/list.php
+++ b/htdocs/accountancy/supplier/list.php
@@ -529,11 +529,12 @@ if ($result) {
while ($i < min($num_lines, $limit)) {
$objp = $db->fetch_object($result);
- // product_type: 0 = service ? 1 = product
+ // product_type: 0 = service, 1 = product
// if product does not exist we use the value of product_type provided in facturedet to define if this is a product or service
// issue : if we change product_type value in product DB it should differ from the value stored in facturedet DB !
$objp->code_buy_l = '';
$objp->code_buy_p = '';
+ $objp->aarowid_suggest = ''; // Will be set later
$thirdpartystatic->id = $objp->socid;
$thirdpartystatic->name = $objp->name;
@@ -575,10 +576,6 @@ if ($result) {
$facturefourn_static_det->product_type = $objp->type_l;
$facturefourn_static_det->desc = $objp->description;
- $code_buy_p_notset = '';
- $code_buy_t_notset = '';
- $objp->aarowid_suggest = ''; // Will be set later
-
$accountingAccountArray = array(
'dom'=>$objp->aarowid,
'intra'=>$objp->aarowid_intra,
@@ -595,12 +592,15 @@ if ($result) {
$suggestedid=$return['suggestedid'];
$suggestedaccountingaccountfor=$return['suggestedaccountingaccountfor'];
$suggestedaccountingaccountbydefaultfor=$return['suggestedaccountingaccountbydefaultfor'];
- $code_buy_l=$return['code_buy_l'];
- $code_buy_p=$return['code_buy_p'];
- $code_buy_t=$return['code_buy_t'];
+ $code_buy_l=$return['code_l'];
+ $code_buy_p=$return['code_p'];
+ $code_buy_t=$return['code_t'];
}
//var_dump($return);
+ // Level 3: Search suggested account for this thirdparty (similar code exists in page index.php to make automatic binding)
+ // Not supported for suppliers
+
if (!empty($code_buy_p)) {
// Value was defined previously
} else {
@@ -654,11 +654,11 @@ if ($result) {
print '';
// Vat rate
- $code_vat_differ='';
- if ($objp->vat_tx_l != $objp->vat_tx_p && ! empty($objp->vat_tx_l)) { // Note: having a vat rate of 0 is often the normal case when sells is intra b2b or to export
- $code_vat_differ = 'font-weight:bold; text-decoration:blink; color:red';
+ $code_vat_differ = '';
+ if ($objp->vat_tx_l != $objp->vat_tx_p && price2num($objp->vat_tx_p) && price2num($objp->vat_tx_l)) { // Note: having a vat rate of 0 is often the normal case when sells is intra b2b or to export
+ $code_vat_differ = 'warning bold';
}
- print '