Merge remote-tracking branch 'Dolibarr/13.0' into 13

.travis.yml

@@ -1,6 +1,6 @@
 # This script is used by Travis CI to run automatically Continuous test integration
 # from Dolibarr GitHub repository.
-# For syntax, see http://about.travis-ci.org/docs/user/languages/php/
+# For syntax, see https://docs.travis-ci.com/user/languages/php/
 
 # We use dist: xenial to have php 5.6+ available
 os: linux
@@ -9,6 +9,9 @@ dist: xenial
 
 language: php
 
+git:
+  depth: 1
+
 # Start on every boot
 services:
 - memcached
@@ -38,8 +41,8 @@ env:
 
 jobs:
   fast_finish: true
-  allow_failures:
+  #allow_failures:
-  - php: nightly
+  #- php: nightly
   include:
     - if: type = push
       php: '5.6'
@@ -50,7 +53,7 @@ jobs:
     - if: type = push AND branch = develop
       php: nightly 
       env: DB=mysql
-    - if: type = push AND branch = 13.0
+    - if: type = push AND branch = 14.0
       php: nightly 
       env: DB=mysql
 
@@ -73,13 +76,6 @@ before_install:
   phpenv config-rm xdebug.ini
   echo
 
-- |
-  if [ "$DB" = 'postgresql' ]; then
-    echo "Check pgloader version"
-    pgloader --version
-    echo
-  fi
-
 install:
 - |
   echo "Updating Composer"
@@ -178,6 +174,10 @@ before_script:
     mysql --version | head -
     mysql -e "SELECT VERSION();"  | head -
     psql --version
+    if [ "$DB" = 'postgresql' ]; then
+      echo "Check pgloader version"
+      pgloader --version
+    fi
     echo
 
   - |
@@ -267,24 +267,27 @@ script:
   echo
 
 - |
-  echo "Checking PHP syntax errors"
+  echo "Checking PHP syntax errors (only 1 version to not overload travis and avoid duplicate tests)"
   # Ensure we catch errors
   set -e
   #parallel-lint --exclude htdocs/includes --blame .
-  parallel-lint --exclude dev/tools/test/namespacemig --exclude htdocs/includes/composer --exclude htdocs/includes/myclabs --exclude htdocs/includes/phpspec --exclude dev/initdata/dbf/includes \
+  # Exclusions are defined in the ruleset.xml file
-  	--exclude htdocs/includes/sabre --exclude htdocs/includes/phpoffice/PhpSpreadsheet --exclude htdocs/includes/sebastian \
+  if [ "$TRAVIS_PHP_VERSION" = "7.4" ]; then
-  	--exclude htdocs/includes/squizlabs/php_codesniffer --exclude htdocs/includes/jakub-onderka --exclude htdocs/includes/php-parallel-lint --exclude htdocs/includes/symfony \
+    parallel-lint -e php --exclude dev/tools/test/namespacemig --exclude htdocs/includes/composer --exclude htdocs/includes/myclabs --exclude htdocs/includes/phpspec --exclude dev/initdata/dbf/includes \
-  	--exclude htdocs/includes/mike42/escpos-php/example --exclude htdocs/includes/maximebf \
+      --exclude htdocs/includes/sabre --exclude htdocs/includes/phpoffice/PhpSpreadsheet --exclude htdocs/includes/sebastian \
-  	--exclude htdocs/includes/phpunit/ --exclude htdocs/includes/tecnickcom/tcpdf/include/barcodes --exclude htdocs/includes/webmozart --blame .
+      --exclude htdocs/includes/squizlabs/php_codesniffer --exclude htdocs/includes/jakub-onderka --exclude htdocs/includes/php-parallel-lint --exclude htdocs/includes/symfony \
+      --exclude htdocs/includes/mike42/escpos-php/example --exclude htdocs/includes/maximebf \
+      --exclude htdocs/includes/phpunit/ --exclude htdocs/includes/tecnickcom/tcpdf/include/barcodes --exclude htdocs/includes/webmozart --blame .
+  fi
   set +e
   echo
 
 - |
-  echo "Checking coding style (excluding Pull Requests builds to not overload travis, excluding also some jobs to avoid duplicate tests)"
+  echo "Checking coding style (only for Pull Requests builds and 1 version to not overload travis and avoid duplicate tests)"
   # Ensure we catch errors
   set -e
   # Exclusions are defined in the ruleset.xml file
-  if [ "$TRAVIS_PULL_REQUEST" = "false" ] && [ "$TRAVIS_PHP_VERSION" = "7.4" ] && [ "$DB" = "mysql" ]; then
+  if [ "$TRAVIS_PULL_REQUEST" = "false" ] && [ "$TRAVIS_PHP_VERSION" = "7.4" ]; then
     phpcs -s -p -d memory_limit=-1 --extensions=php --colors --tab-width=4 --standard=dev/setup/codesniffer/ruleset.xml --encoding=utf-8 --runtime-set ignore_warnings_on_exit true .;
   fi
   set +e
@@ -401,8 +404,12 @@ script:
   php upgrade.php 12.0.0 13.0.0 ignoredbversion > $TRAVIS_BUILD_DIR/upgrade12001300.log
   php upgrade2.php 12.0.0 13.0.0 > $TRAVIS_BUILD_DIR/upgrade12001300-2.log
   php step5.php 12.0.0 13.0.0 > $TRAVIS_BUILD_DIR/upgrade12001300-3.log
+  ls -alrt $TRAVIS_BUILD_DIR/
 
+- |
+  echo "Enabling new modules"
   # Enable modules not enabled into original dump
+  cd htdocs/install
   php upgrade2.php 0.0.0 0.0.0 MAIN_MODULE_API,MAIN_MODULE_PRODUCTBATCH,MAIN_MODULE_SUPPLIERPROPOSAL,MAIN_MODULE_STRIPE > $TRAVIS_BUILD_DIR/enablemodule.log
   php upgrade2.php 0.0.0 0.0.0 MAIN_MODULE_WEBSITE,MAIN_MODULE_TICKET,MAIN_MODULE_ACCOUNTING,MAIN_MODULE_MRP >> $TRAVIS_BUILD_DIR/enablemodule.log
   php upgrade2.php 0.0.0 0.0.0 MAIN_MODULE_RECEPTION,MAIN_MODULE_RECRUITMENT >> $TRAVIS_BUILD_DIR/enablemodule.log

ChangeLog

@@ -12,6 +12,8 @@ FIX: #17060
 FIX: #17192 - With tz < 0, event is show in bad day on calendar views
 FIX: #17363
 FIX: #17476 releve.php: Fix SQL statement
+FIX: #17967
+Fix: #17906 : fix access denied
 FIX: Accountancy - Import in general ledger
 FIX: Accountancy - Quadra export - wrong data on credit
 FIX: Accountancy - Warning on the pages of the preparatory statements of accounting entries

README.md

@@ -169,7 +169,7 @@ See the [ChangeLog](https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog)
 
 ### System Environment / Requirements
 
-- Works with PHP 5.6+ and MariaDB 5.0.3+, MySQL 5.0.3+ or PostgreSQL 8.1.4+ (See requirements on the [Wiki](https://wiki.dolibarr.org/index.php/Prerequisite))
+- Works with PHP 5.6-7.4 and MariaDB 5.0.3+, MySQL 5.0.3+ or PostgreSQL 8.1.4+ (See exact requirements on the [Wiki](https://wiki.dolibarr.org/index.php/Prerequisite))
 - Compatible with all Cloud solutions that match PHP & MySQL or PostgreSQL prerequisites.
 
 

doc/index.html

@@ -17,8 +17,6 @@ on Internet on web following sites:<br>
 <br>
 * <a href="https://demo.dolibarr.org">Dolibarr demo (online)</a><br>
 <br>
-* <a href="https://www.nltechno.com/pages/dolibarrwinbin.php">DoliWamp, the Dolibarr for Windows</a><br>
-<br>
 * <a href="https://www.dolistore.com">DoliStore (official addons/plugins market place)</a><br>
 
 </body>

doc/install/README

@@ -19,7 +19,7 @@ Download
 Install
 --------------------------------
 
-* For a Quick guide, take a look at README file into root directory.
+* For a Quick guide, take a look at README.md file into root directory.
 
 * More complete documentations are also available on line on the Dolibarr Wiki:
     https://wiki.dolibarr.org

doc/install/README-DE

@@ -23,7 +23,7 @@ Download / Herunterladen
 Installation / Hilfe
 ------------------------------------
 
-* Für eine kurze Einleitung schau in die README Datei im Hauptverzeichnis.
+* Für eine kurze Einleitung schau in die README.md Datei im Hauptverzeichnis.
 
 * Umfangreiche Dokumentationen sind im Dolibarr Wiki zu finden:
     https://wiki.dolibarr.org/index.php/Hauptseite 

doc/install/README-FR

@@ -20,9 +20,7 @@ https://www.dolistore.com
 Documentation utilisateur
 --------------------------------
 
-* Pour une prise en main et installation rapide, consultez le fichier
+* Pour une prise en main et installation rapide, consultez le fichier README-FR.md à la racine.
-README-FR à la racine.
 
-* Une documentation utilisateur francophone plus consistante est disponible en
+* Une documentation utilisateur francophone plus consistante est disponible en ligne sur le wiki de Dolibarr à l'adresse:
-ligne sur le wiki de Dolibarr à l'adresse:
+    https://wiki.dolibarr.org
-https://wiki.dolibarr.org/index.php/Accueil

doc/user/README

@@ -4,4 +4,5 @@ User guide
 --------------------------------
 
 * All Dolibarr guides are available, on line, on the Dolibarr Web site:
+
 https://www.dolibarr.org

doc/user/README-FR

@@ -3,9 +3,6 @@ README (french)
 Documentation utilisateur
 --------------------------------
 
-* Pour une prise en main et installation rapide, consultez le fichier
+La documentation utilisateur francophone est disponible en ligne sur le site Web de Dolibarr à l'adresse:
-README-FR à la racine.
 
-* Une documentation utilisateur francophone plus consistante est disponible en
-ligne sur le site Web de Dolibarr à l'adresse:
 https://www.dolibarr.fr

htdocs/adherents/class/adherent.class.php

@@ -1412,7 +1412,7 @@ class Adherent extends CommonObject
 					$this->first_subscription_amount = $obj->subscription;
 				}
 				$this->last_subscription_date = $this->db->jdate($obj->datec);
-				$this->last_subscription_date_start = $this->db->jdate($obj->datef);
+				$this->last_subscription_date_start = $this->db->jdate($obj->dateh);
 				$this->last_subscription_date_end = $this->db->jdate($obj->datef);
 				$this->last_subscription_amount = $obj->subscription;
 

htdocs/admin/dict.php

@@ -2018,10 +2018,10 @@ function fieldList($fieldlist, $obj = '', $tabname = '', $context = '')
 			if (in_array($fieldlist[$field], array('label', 'libelle')))		// For label
 			{
 				// Special case for labels
-				if ($tabname == MAIN_DB_PREFIX.'c_civility') {
+				if ($tabname == MAIN_DB_PREFIX.'c_civility' && !empty($obj->code)) {
 					$transkey = "Civility".strtoupper($obj->code);
 				}
-				if ($tabname == MAIN_DB_PREFIX.'c_payment_term') {
+				if ($tabname == MAIN_DB_PREFIX.'c_payment_term' && !empty($obj->code)) {
 					$langs->load("bills");
 					$transkey = "PaymentConditionShort".strtoupper($obj->code);
 				}

htdocs/admin/modules.php

@@ -28,7 +28,7 @@
  *  \brief      Page to activate/disable all modules
  */
 
-if (!defined('CSRFCHECK_WITH_TOKEN')) {
+if (!defined('CSRFCHECK_WITH_TOKEN') && (empty($_GET['action']) || $_GET['action'] != 'reset')) {	// We do not force security to disable modules so we can do it if problem
 	define('CSRFCHECK_WITH_TOKEN', '1'); // Force use of CSRF protection with tokens even for GET
 }
 

htdocs/bookmarks/bookmarks.lib.php

@@ -45,15 +45,15 @@ function printDropdownBookmarksList()
 		$tmpurl = '';
 		// No urlencode, all param $url will be urlencoded later
 		if ($sortfield) {
-			$tmpurl .= ($tmpurl ? '&' : '').'sortfield='.$sortfield;
+			$tmpurl .= ($tmpurl ? '&' : '').'sortfield='.urlencode($sortfield);
 		}
 		if ($sortorder) {
-			$tmpurl .= ($tmpurl ? '&' : '').'sortorder='.$sortorder;
+			$tmpurl .= ($tmpurl ? '&' : '').'sortorder='.urlencode($sortorder);
 		}
 		if (is_array($_POST)) {
 			foreach ($_POST as $key => $val) {
 				if (preg_match('/^search_/', $key) && $val != '') {
-					$tmpurl .= ($tmpurl ? '&' : '').$key.'='.$val;
+					$tmpurl .= ($tmpurl ? '&' : '').http_build_query(array($key => $val));
 				}
 			}
 		}

htdocs/comm/action/class/actioncomm.class.php

@@ -683,6 +683,10 @@ class ActionComm extends CommonObject
 	{
 		global $langs;
 
+		if (empty($id) && empty($ref) && empty($ref_ext) && empty($email_msgid)) {
+			return -1;
+		}
+
 		$sql = "SELECT a.id,";
 		$sql .= " a.id as ref,";
 		$sql .= " a.entity,";

htdocs/comm/mailing/class/mailing.class.php

@@ -477,22 +477,46 @@ class Mailing extends CommonObject
 	/**
 	 *  Delete emailing
 	 *
-	 *  @param	int		$rowid      id du mailing a supprimer
+	 *  @param	int		$rowid      Id if emailing to delete
-	 *  @return int         		1 en cas de succes
+	 *  @param	int		$notrigger	Disable triggers
+	 *  @return int         		>0 if OK, <0 if KO
 	 */
-	public function delete($rowid)
+	public function delete($rowid, $notrigger = 0)
 	{
+		global $user;
+
+		$this->db->begin();
+
 		$sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing";
 		$sql .= " WHERE rowid = ".$rowid;
 
 		dol_syslog("Mailing::delete", LOG_DEBUG);
 		$resql = $this->db->query($sql);
-		if ($resql) {
+		if ($resql)
-			return $this->delete_targets();
+		{
+			$res = $this->delete_targets();
+			if ($res <= 0) {
+				$this->db->rollback();
+				$this->error = $this->db->lasterror();
+				return -1;
+			}
 		} else {
+			$this->db->rollback();
 			$this->error = $this->db->lasterror();
 			return -1;
 		}
+
+		if (!$notrigger) {
+			$result = $this->call_trigger('MAILING_DELETE', $user);
+			if ($result < 0)
+			{
+				$this->db->rollback();
+				return -1;
+			}
+		}
+
+		$this->db->commit();
+		return 1;
 	}
 
 	// phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps

htdocs/compta/facture/card.php

@@ -3123,7 +3123,7 @@ if ($action == 'create')
 			// Type de facture
 			$facids = $facturestatic->list_replacable_invoices($soc->id);
 			if ($facids < 0) {
-				dol_print_error($db, $facturestatic);
+				dol_print_error($db, $facturestatic->error, $facturestatic->errors);
 				exit();
 			}
 			$options = "";
@@ -3208,7 +3208,7 @@ if ($action == 'create')
 				$facids = $facturestatic->list_qualified_avoir_invoices($soc->id);
 				if ($facids < 0)
 				{
-					dol_print_error($db, $facturestatic);
+					dol_print_error($db, $facturestatic->error, $facturestatic->errors);
 					exit;
 				}
 				$optionsav = "";
@@ -3656,7 +3656,7 @@ if ($action == 'create')
 
 	$result = $object->fetch($id, $ref);
 	if ($result <= 0) {
-		dol_print_error($db, $object->error);
+		dol_print_error($db, $object->error, $object->errors);
 		exit();
 	}
 

htdocs/compta/facture/class/facture-rec.class.php

@@ -542,11 +542,7 @@ class FactureRec extends CommonInvoice
 				$this->titre                  = $obj->title; // deprecated
 				$this->title                  = $obj->title;
 				$this->ref                    = $obj->title;
-				$this->ref_client             = $obj->ref_client;
 				$this->suspended              = $obj->suspended;
-				$this->type                   = $obj->type;
-				$this->datep                  = $obj->dp;
-				$this->date                   = $obj->df;
 				$this->remise_percent         = $obj->remise_percent;
 				$this->remise_absolue         = $obj->remise_absolue;
 				$this->remise                 = $obj->remise;
@@ -555,9 +551,6 @@ class FactureRec extends CommonInvoice
 				$this->total_localtax1        = $obj->localtax1;
 				$this->total_localtax2        = $obj->localtax2;
 				$this->total_ttc              = $obj->total_ttc;
-				$this->paye                   = $obj->paye;
-				$this->close_code             = $obj->close_code;
-				$this->close_note             = $obj->close_note;
 				$this->socid                  = $obj->fk_soc;
 				$this->date_lim_reglement     = $this->db->jdate($obj->dlr);
 				$this->mode_reglement_id      = $obj->fk_mode_reglement;
@@ -569,14 +562,12 @@ class FactureRec extends CommonInvoice
 				$this->cond_reglement_doc     = $obj->cond_reglement_libelle_doc;
 				$this->fk_project             = $obj->fk_project;
 				$this->fk_account             = $obj->fk_account;
-				$this->fk_facture_source      = $obj->fk_facture_source;
 				$this->note_private           = $obj->note_private;
 				$this->note_public            = $obj->note_public;
 				$this->user_author            = $obj->fk_user_author;
 				$this->modelpdf               = $obj->model_pdf; // deprecatd
 				$this->model_pdf              = $obj->model_pdf;
-				$this->rang = $obj->rang;
+				//$this->special_code = $obj->special_code;
-				$this->special_code = $obj->special_code;
 				$this->frequency			  = $obj->frequency;
 				$this->unit_frequency = $obj->unit_frequency;
 				$this->date_when			  = $this->db->jdate($obj->date_when);
@@ -595,7 +586,9 @@ class FactureRec extends CommonInvoice
 				$this->multicurrency_total_tva 	= $obj->multicurrency_total_tva;
 				$this->multicurrency_total_ttc 	= $obj->multicurrency_total_ttc;
 
-				if ($this->statut == self::STATUS_DRAFT)	$this->brouillon = 1;
+				if ($this->statut == self::STATUS_DRAFT) {
+					$this->brouillon = 1;
+				}
 
 				// Retrieve all extrafield
 				// fetch optionals attributes and labels
@@ -605,14 +598,13 @@ class FactureRec extends CommonInvoice
 				 * Lines
 				 */
 				$result = $this->fetch_lines();
-				if ($result < 0)
+				if ($result < 0) {
-				{
 					$this->error = $this->db->lasterror();
 					return -3;
 				}
 				return 1;
 			} else {
-				$this->error = 'Bill with id '.$rowid.' or ref '.$ref.' not found sql='.$sql;
+				$this->error = 'Bill with id '.$rowid.' or ref '.$ref.' not found';
 				dol_syslog('Facture::Fetch Error '.$this->error, LOG_ERR);
 				return -2;
 			}

htdocs/compta/facture/list.php

@@ -13,7 +13,7 @@
  * Copyright (C) 2015-2021 Ferran Marcet         <fmarcet@2byte.es>
  * Copyright (C) 2017      Josep Lluís Amador    <joseplluis@lliuretic.cat>
  * Copyright (C) 2018      Charlene Benke        <charlie@patas-monkey.com>
- * Copyright (C) 2019	   Alexandre Spangaro	 <aspangaro@open-dsi.fr>
+ * Copyright (C) 2019-2021 Alexandre Spangaro	 <aspangaro@open-dsi.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -108,13 +108,31 @@ $search_country = GETPOST("search_country", 'int');
 $search_type_thirdparty = GETPOST("search_type_thirdparty", 'int');
 $search_user = GETPOST('search_user', 'int');
 $search_sale = GETPOST('search_sale', 'int');
-$search_date_start = dol_mktime(0, 0, 0, GETPOST('search_date_startmonth', 'int'), GETPOST('search_date_startday', 'int'), GETPOST('search_date_startyear', 'int'));
+$search_date_startday = GETPOST('search_date_startday', 'int');
-$search_date_end = dol_mktime(23, 59, 59, GETPOST('search_date_endmonth', 'int'), GETPOST('search_date_endday', 'int'), GETPOST('search_date_endyear', 'int'));
+$search_date_startmonth = GETPOST('search_date_startmonth', 'int');
-$search_date_valid_start = dol_mktime(0, 0, 0, GETPOST('search_date_valid_startmonth', 'int'), GETPOST('search_date_valid_startday', 'int'), GETPOST('search_date_valid_startyear', 'int'));
+$search_date_startyear = GETPOST('search_date_startyear', 'int');
-$search_date_valid_end = dol_mktime(23, 59, 59, GETPOST('search_date_valid_endmonth', 'int'), GETPOST('search_date_valid_endday', 'int'), GETPOST('search_date_valid_endyear', 'int'));
+$search_date_endday = GETPOST('search_date_endday', 'int');
-$search_datelimit_start = dol_mktime(0, 0, 0, GETPOST('search_datelimit_startmonth', 'int'), GETPOST('search_datelimit_startday', 'int'), GETPOST('search_datelimit_startyear', 'int'));
+$search_date_endmonth = GETPOST('search_date_endmonth', 'int');
-$search_datelimit_end = dol_mktime(23, 59, 59, GETPOST('search_datelimit_endmonth', 'int'), GETPOST('search_datelimit_endday', 'int'), GETPOST('search_datelimit_endyear', 'int'));
+$search_date_endyear = GETPOST('search_date_endyear', 'int');
-$search_categ_cus = GETPOST("search_categ_cus", 'int');
+$search_date_start = dol_mktime(0, 0, 0, $search_date_startmonth, $search_date_startday, $search_date_startyear);	// Use tzserver
+$search_date_end = dol_mktime(23, 59, 59, $search_date_endmonth, $search_date_endday, $search_date_endyear);
+$search_date_valid_startday = GETPOST('search_date_valid_startday', 'int');
+$search_date_valid_startmonth = GETPOST('search_date_valid_startmonth', 'int');
+$search_date_valid_startyear = GETPOST('search_date_valid_startyear', 'int');
+$search_date_valid_endday = GETPOST('search_date_valid_endday', 'int');
+$search_date_valid_endmonth = GETPOST('search_date_valid_endmonth', 'int');
+$search_date_valid_endyear = GETPOST('search_date_valid_endyear', 'int');
+$search_date_valid_start = dol_mktime(0, 0, 0, $search_date_valid_startmonth, $search_date_valid_startday, $search_date_valid_startyear);
+$search_date_valid_end = dol_mktime(23, 59, 59, $search_date_valid_endmonth, $search_date_valid_endday, $search_date_valid_endyear);
+$search_datelimit_startday = GETPOST('search_datelimit_startday', 'int');
+$search_datelimit_startmonth = GETPOST('search_datelimit_startmonth', 'int');
+$search_datelimit_startyear = GETPOST('search_datelimit_startyear', 'int');
+$search_datelimit_endday = GETPOST('search_datelimit_endday', 'int');
+$search_datelimit_endmonth = GETPOST('search_datelimit_endmonth', 'int');
+$search_datelimit_endyear = GETPOST('search_datelimit_endyear', 'int');
+$search_datelimit_start = dol_mktime(0, 0, 0, $search_datelimit_startmonth, $search_datelimit_startday, $search_datelimit_startyear);
+$search_datelimit_end = dol_mktime(23, 59, 59, $search_datelimit_endmonth, $search_datelimit_endday, $search_datelimit_endyear);
+$search_categ_cus = trim(GETPOST("search_categ_cus", 'int'));
 $search_btn = GETPOST('button_search', 'alpha');
 $search_remove_btn = GETPOST('button_removefilter', 'alpha');
 
@@ -276,10 +294,28 @@ if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter',
 	$search_type = '';
 	$search_country = '';
 	$search_type_thirdparty = '';
+	$search_date_startday = '';
+	$search_date_startmonth = '';
+	$search_date_startyear = '';
+	$search_date_endday = '';
+	$search_date_endmonth = '';
+	$search_date_endyear = '';
 	$search_date_start = '';
 	$search_date_end = '';
+	$search_date_valid_startday = '';
+	$search_date_valid_startmonth = '';
+	$search_date_valid_startyear = '';
+	$search_date_valid_endday = '';
+	$search_date_valid_endmonth = '';
+	$search_date_valid_endyear = '';
 	$search_date_valid_start = '';
 	$search_date_valid_end = '';
+	$search_datelimit_startday = '';
+	$search_datelimit_startmonth = '';
+	$search_datelimit_startyear = '';
+	$search_datelimit_endday = '';
+	$search_datelimit_endmonth = '';
+	$search_datelimit_endyear = '';
 	$search_datelimit_start = '';
 	$search_datelimit_end = '';
 	$option = '';
@@ -491,7 +527,6 @@ if ($search_zip)   $sql .= natural_search("s.zip", $search_zip);
 if ($search_state) $sql .= natural_search("state.nom", $search_state);
 if ($search_country) $sql .= " AND s.fk_pays IN (".$db->sanitize($db->escape($search_country)).')';
 if ($search_type_thirdparty) $sql .= " AND s.fk_typent IN (".$db->sanitize($db->escape($search_type_thirdparty)).')';
-if ($search_company) $sql .= natural_search('s.nom', $search_company);
 if ($search_montant_ht != '') $sql .= natural_search('f.total', $search_montant_ht, 1);
 if ($search_montant_vat != '') $sql .= natural_search('f.tva', $search_montant_vat, 1);
 if ($search_montant_localtax1 != '') $sql .= natural_search('f.localtax1', $search_montant_localtax1, 1);
@@ -616,12 +651,24 @@ if ($resql)
 	if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.urlencode($contextpage);
 	if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit);
 	if ($sall)				 $param .= '&sall='.urlencode($sall);
-	if ($search_date_start)				$param .= '&search_date_startday='.urlencode(dol_print_date($search_date_start, '%d')).'&search_date_startmonth='.urlencode(dol_print_date($search_date_start, '%m')).'&search_date_startyear='.urlencode(dol_print_date($search_date_start, '%Y'));
+	if ($search_date_startday)		$param .= '&search_date_startday='.urlencode($search_date_startday);
-	if ($search_date_end)				$param .= '&search_date_endday='.urlencode(dol_print_date($search_date_end, '%d')).'&search_date_endmonth='.urlencode(dol_print_date($search_date_end, '%m')).'&search_date_endyear='.urlencode(dol_print_date($search_date_end, '%Y'));
+	if ($search_date_startmonth)	$param .= '&search_date_startmonth='.urlencode($search_date_startmonth);
-	if ($search_date_valid_start)		$param .= '&search_date_valid_startday='.urlencode(dol_print_date($search_date_valid_start, '%d')).'&search_date_valid_startmonth='.urlencode(dol_print_date($search_date_valid_start, '%m')).'&search_date_valid_startyear='.urlencode(dol_print_date($search_date_valid_start, '%Y'));
+	if ($search_date_startyear)		$param .= '&search_date_startyear='.urlencode($search_date_startyear);
-	if ($search_date_valid_end)			$param .= '&search_date_valid_endday='.urlencode(dol_print_date($search_date_valid_end, '%d')).'&search_date_valid_endmonth='.urlencode(dol_print_date($search_date_valid_end, '%m')).'&search_date_valid_endyear='.urlencode(dol_print_date($search_date_valid_end, '%Y'));
+	if ($search_date_endday)		$param .= '&search_date_endday='.urlencode($search_date_endday);
-	if ($search_datelimit_start)		$param .= '&search_datelimit_startday='.urlencode(dol_print_date($search_datelimit_start, '%d')).'&search_datelimit_startmonth='.urlencode(dol_print_date($search_datelimit_start, '%m')).'&search_datelimit_startyear='.urlencode(dol_print_date($search_datelimit_start, '%Y'));
+	if ($search_date_endmonth)		$param .= '&search_date_endmonth='.urlencode($search_date_endmonth);
-	if ($search_datelimit_end)			$param .= '&search_datelimit_endday='.urlencode(dol_print_date($search_datelimit_end, '%d')).'&search_datelimit_endmonth='.urlencode(dol_print_date($search_datelimit_end, '%m')).'&search_datelimit_endyear='.urlencode(dol_print_date($search_datelimit_end, '%Y'));
+	if ($search_date_endyear)		$param .= '&search_date_endyear='.urlencode($search_date_endyear);
+	if ($search_date_valid_startday)		$param .= '&search_date_valid_startday='.urlencode($search_date_valid_startday);
+	if ($search_date_valid_startmonth)		$param .= '&search_date_valid_startmonth='.urlencode($search_date_valid_startmonth);
+	if ($search_date_valid_startyear)		$param .= '&search_date_valid_startyear='.urlencode($search_date_valid_startyear);
+	if ($search_date_valid_endday)			$param .= '&search_date_valid_endday='.urlencode($search_date_valid_endday);
+	if ($search_date_valid_endmonth)		$param .= '&search_date_valid_endmonth='.urlencode($search_date_valid_endmonth);
+	if ($search_date_valid_endyear)			$param .= '&search_date_valid_endyear='.urlencode($search_date_valid_endyear);
+	if ($search_datelimit_startday)		$param .= '&search_datelimit_startday='.urlencode($search_datelimit_startday);
+	if ($search_datelimit_startmonth)	$param .= '&search_datelimit_startmonth='.urlencode($search_datelimit_startmonth);
+	if ($search_datelimit_startyear)	$param .= '&search_datelimit_startyear='.urlencode($search_datelimit_startyear);
+	if ($search_datelimit_endday)		$param .= '&search_datelimit_endday='.urlencode($search_datelimit_endday);
+	if ($search_datelimit_endmonth)		$param .= '&search_datelimit_endmonth='.urlencode($search_datelimit_endmonth);
+	if ($search_datelimit_endyear)		$param .= '&search_datelimit_endyear='.urlencode($search_datelimit_endyear);
 	if ($search_ref)         $param .= '&search_ref='.urlencode($search_ref);
 	if ($search_refcustomer) $param .= '&search_refcustomer='.urlencode($search_refcustomer);
 	if ($search_project_ref) $param .= '&search_project_ref='.urlencode($search_project_ref);

htdocs/compta/stats/cabyprodserv.php

@@ -231,8 +231,6 @@ if ($modecompta == 'CREANCES-DETTES')
 	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON l.fk_product = p.rowid";
 	if ($selected_cat === -2) {	// Without any category
 		$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."categorie_product as cp ON p.rowid = cp.fk_product";
-	} elseif ($selected_cat) { 	// Into a specific category
-		$sql .= ", ".MAIN_DB_PREFIX."categorie as c, ".MAIN_DB_PREFIX."categorie_product as cp";
 	}
 	$sql .= " WHERE l.fk_facture = f.rowid";
 	$sql .= " AND f.fk_statut in (1,2)";

htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php

@@ -40,7 +40,7 @@ echo $this->control->tpl['ajax_selectcountry']; ?>
 <br>
 
 <form method="post" name="formsoc" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="action" value="add">
 <?php if ($this->control->tpl['company_id']) { ?>

htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php

@@ -40,7 +40,7 @@ echo $this->control->tpl['ajax_selectcountry'];
 <br>
 
 <form method="post" name="formsoc" action="<?php echo $_SERVER["PHP_SELF"].'?id='.GETPOST('id', 'int'); ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="id" value="<?php echo GETPOST('id', 'int'); ?>">
 <input type="hidden" name="action" value="update">

htdocs/core/actions_massactions.inc.php

@@ -956,8 +956,12 @@ if (!$error && $massaction == "builddoc" && $permissiontoread && !GETPOST('butto
 	// Define output language (Here it is not used because we do only merging existing PDF)
 	$outputlangs = $langs;
 	$newlang = '';
-	if ($conf->global->MAIN_MULTILANGS && empty($newlang) && GETPOST('lang_id', 'aZ09')) $newlang = GETPOST('lang_id', 'aZ09');
+	if ($conf->global->MAIN_MULTILANGS && empty($newlang) && GETPOST('lang_id', 'aZ09')) {
-	if ($conf->global->MAIN_MULTILANGS && empty($newlang)) $newlang = $objecttmp->thirdparty->default_lang;
+		$newlang = GETPOST('lang_id', 'aZ09');
+	}
+	//elseif ($conf->global->MAIN_MULTILANGS && empty($newlang) && is_object($objecttmp->thirdparty)) {		// On massaction, we can have several values for $objecttmp->thirdparty
+	//	$newlang = $objecttmp->thirdparty->default_lang;
+	//}
 	if (!empty($newlang)) {
 		$outputlangs = new Translate("", $conf);
 		$outputlangs->setDefaultLang($newlang);

htdocs/core/class/CSMSFile.class.php

@@ -80,7 +80,7 @@ class CSMSFile
 			return -1;
 		}
 
-		dol_syslog("CSMSFile::CSMSFile: MAIN_SMS_SENDMODE=".$conf->global->MAIN_SMS_SENDMODE." charset=".$conf->file->character_set_client." from=".$from.", to=".$to.", msg length=".count($msg), LOG_DEBUG);
+		dol_syslog("CSMSFile::CSMSFile: MAIN_SMS_SENDMODE=".$conf->global->MAIN_SMS_SENDMODE." charset=".$conf->file->character_set_client." from=".$from.", to=".$to.", msg length=".strlen($msg), LOG_DEBUG);
 		dol_syslog("CSMSFile::CSMSFile: deferred=".$deferred." priority=".$priority." class=".$class, LOG_DEBUG);
 
 		// Action according to choosed sending method

htdocs/core/class/commonobject.class.php

@@ -497,8 +497,8 @@ abstract class CommonObject
 
 	/**
 	 * @var array    List of child tables. To know object to delete on cascade.
-	 *               If name matches '@ClassNAme:FilePathClass;ParentFkFieldName' it will
+	 *               If name is like '@ClassName:FilePathClass:ParentFkFieldName', it will
-	 *               call method deleteByParentField(parentId, ParentFkFieldName) to fetch and delete child object
+	 *               call method deleteByParentField(parentId, ParentFkFieldName) to fetch and delete child object.
 	 */
 	protected $childtablesoncascade = array();
 

htdocs/core/class/discount.class.php

@@ -519,7 +519,7 @@ class DiscountAbsolute
 			//}
 			if ($multicurrency)
 			{
-				return $obj->amount_multicurrency;
+				return $obj->multicurrency_amount;
 			}
 
 			return $obj->amount;

htdocs/core/lib/functions.lib.php

@@ -6615,11 +6615,11 @@ function getCommonSubstitutionArray($outputlangs, $onlykey = 0, $exclude = null,
 		if ($onlykey != 2 || $mysoc->useLocalTax(1)) $substitutionarray['__AMOUNT_TAX2__']     = is_object($object) ? $object->total_localtax1 : '';
 		if ($onlykey != 2 || $mysoc->useLocalTax(2)) $substitutionarray['__AMOUNT_TAX3__']     = is_object($object) ? $object->total_localtax2 : '';
 
-		$substitutionarray['__AMOUNT_FORMATED__']          = is_object($object) ? ($object->total_ttc ? price($object->total_ttc, 0, $outputlangs, 0, 0, -1, $conf->currency) : null) : '';
+		$substitutionarray['__AMOUNT_FORMATED__']          = is_object($object) ? ($object->total_ttc ? price($object->total_ttc, 0, $outputlangs, 0, -1, -1, $conf->currency) : null) : '';
-		$substitutionarray['__AMOUNT_EXCL_TAX_FORMATED__'] = is_object($object) ? ($object->total_ht ? price($object->total_ht, 0, $outputlangs, 0, 0, -1, $conf->currency) : null) : '';
+		$substitutionarray['__AMOUNT_EXCL_TAX_FORMATED__'] = is_object($object) ? ($object->total_ht ? price($object->total_ht, 0, $outputlangs, 0, -1, -1, $conf->currency) : null) : '';
-		$substitutionarray['__AMOUNT_VAT_FORMATED__']      = is_object($object) ? (isset($object->total_vat) ? price($object->total_vat, 0, $outputlangs, 0, 0, -1, $conf->currency) : ($object->total_tva ? price($object->total_tva, 0, $outputlangs, 0, 0, -1, $conf->currency) : null)) : '';
+		$substitutionarray['__AMOUNT_VAT_FORMATED__']      = is_object($object) ? (isset($object->total_vat) ? price($object->total_vat, 0, $outputlangs, 0, -1, -1, $conf->currency) : ($object->total_tva ? price($object->total_tva, 0, $outputlangs, 0, -1, -1, $conf->currency) : null)) : '';
-		if ($onlykey != 2 || $mysoc->useLocalTax(1)) $substitutionarray['__AMOUNT_TAX2_FORMATED__']     = is_object($object) ? ($object->total_localtax1 ? price($object->total_localtax1, 0, $outputlangs, 0, 0, -1, $conf->currency) : null) : '';
+		if ($onlykey != 2 || $mysoc->useLocalTax(1)) $substitutionarray['__AMOUNT_TAX2_FORMATED__']     = is_object($object) ? ($object->total_localtax1 ? price($object->total_localtax1, 0, $outputlangs, 0, -1, -1, $conf->currency) : null) : '';
-		if ($onlykey != 2 || $mysoc->useLocalTax(2)) $substitutionarray['__AMOUNT_TAX3_FORMATED__']     = is_object($object) ? ($object->total_localtax2 ? price($object->total_localtax2, 0, $outputlangs, 0, 0, -1, $conf->currency) : null) : '';
+		if ($onlykey != 2 || $mysoc->useLocalTax(2)) $substitutionarray['__AMOUNT_TAX3_FORMATED__']     = is_object($object) ? ($object->total_localtax2 ? price($object->total_localtax2, 0, $outputlangs, 0, -1, -1, $conf->currency) : null) : '';
 
 		$substitutionarray['__AMOUNT_MULTICURRENCY__']          = (is_object($object) && isset($object->multicurrency_total_ttc)) ? $object->multicurrency_total_ttc : '';
 		$substitutionarray['__AMOUNT_MULTICURRENCY_TEXT__']     = (is_object($object) && isset($object->multicurrency_total_ttc)) ? dol_convertToWord($object->multicurrency_total_ttc, $outputlangs, '', true) : '';

htdocs/core/lib/pdf.lib.php

@@ -621,8 +621,8 @@ function pdf_pagehead(&$pdf, $outputlangs, $page_height)
 {
 	global $conf;
 
-	// Add a background image on document
+	// Add a background image on document only if good setup of const
-	if (!empty($conf->global->MAIN_USE_BACKGROUND_ON_PDF))		// Warning, this option make TCPDF generation being crazy and some content disappeared behind the image
+	if (!empty($conf->global->MAIN_USE_BACKGROUND_ON_PDF) && ($conf->global->MAIN_USE_BACKGROUND_ON_PDF != '-1'))		// Warning, this option make TCPDF generation being crazy and some content disappeared behind the image
 	{
 		$pdf->SetAutoPageBreak(0, 0); // Disable auto pagebreak before adding image
 		$pdf->Image($conf->mycompany->dir_output.'/logos/'.$conf->global->MAIN_USE_BACKGROUND_ON_PDF, (isset($conf->global->MAIN_USE_BACKGROUND_ON_PDF_X) ? $conf->global->MAIN_USE_BACKGROUND_ON_PDF_X : 0), (isset($conf->global->MAIN_USE_BACKGROUND_ON_PDF_Y) ? $conf->global->MAIN_USE_BACKGROUND_ON_PDF_Y : 0), 0, $page_height);
@@ -1272,9 +1272,7 @@ function pdf_getlinedesc($object, $i, $outputlangs, $hideref = 0, $hidedesc = 0,
 			if (!empty($prodser->multilangs[$outputlangs->defaultlang]["note"]) && ($textwasmodified || $translatealsoifmodified))  $note = $prodser->multilangs[$outputlangs->defaultlang]["note"];
 		}
 	} elseif ($object->element == 'facture' || $object->element == 'facturefourn') {
-		if ($object->type == $object::TYPE_DEPOSIT) {
+		$desc = str_replace('(DEPOSIT)', $outputlangs->trans('Deposit'), $desc);
-			$desc = str_replace('(DEPOSIT)', $outputlangs->trans('Deposit'), $desc);
-		}
 	}
 
 	// Description short of product line

htdocs/core/modules/modFournisseur.class.php

@@ -489,7 +489,8 @@ class modFournisseur extends DolibarrModules
 					case 'sellist':
 						$tmp = '';
 						$tmpparam = unserialize($obj->param); // $tmp ay be array 'options' => array 'c_currencies:code_iso:code_iso' => null
-						if ($tmpparam['options'] && is_array($tmpparam['options'])) $tmp = array_shift(array_keys($tmpparam['options']));
+						$array_keys = array_keys($tmpparam['options']);
+						if ($tmpparam['options'] && is_array($tmpparam['options'])) $tmp = array_shift($array_keys);
 						if (preg_match('/[a-z0-9_]+:[a-z0-9_]+:[a-z0-9_]+/', $tmp)) $typeFilter = "List:".$tmp;
 						break;
 				}

htdocs/core/tpl/admin_extrafields_add.tpl.php

@@ -141,7 +141,7 @@ $listofexamplesforlink = 'Societe:societe/class/societe.class.php<br>Contact:con
 </script>
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="post">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="add">
 
 <?php print dol_get_fiche_head(); ?>

htdocs/core/tpl/contacts.tpl.php

@@ -96,7 +96,7 @@ if ($permission)
 	{
 		?>
 	<form class="tagtr impair nohover" action="<?php echo $_SERVER["PHP_SELF"].'?id='.$object->id; ?>" method="POST">
-	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 	<input type="hidden" name="id" value="<?php echo $object->id; ?>" />
 	<input type="hidden" name="action" value="addcontact" />
 	<input type="hidden" name="source" value="internal" />
@@ -121,7 +121,7 @@ if ($permission)
 		?>
 
 	<form class="tagtr pair nohover" action="<?php echo $_SERVER["PHP_SELF"].'?id='.$object->id; ?>" method="POST">
-	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 	<input type="hidden" name="id" value="<?php echo $object->id; ?>" />
 	<input type="hidden" name="action" value="addcontact" />
 	<input type="hidden" name="source" value="external" />

htdocs/core/tpl/passwordforgotten.tpl.php

@@ -74,7 +74,7 @@ $(document).ready(function () {
 <div class="login_vertical_align">
 
 <form id="login" name="login" method="POST" action="<?php echo $php_self; ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="buildnewpassword">
 
 

htdocs/core/triggers/interface_90_modSociete_ContactRoles.class.php

@@ -82,12 +82,9 @@ class InterfaceContactRoles extends DolibarrTriggers
 
 				if (is_array($TContact) && !empty($TContact)) {
 					$TContactAlreadyLinked = array();
-					if ($object->id > 0) {
-						$cloneFrom = dol_clone($object, 1);
 
-						if (!empty($cloneFrom->id)) {
+					if ($object->id > 0) {
-							$TContactAlreadyLinked = array_merge($cloneFrom->liste_contact(-1, 'external'), $cloneFrom->liste_contact(-1, 'internal'));
+						$TContactAlreadyLinked = array_merge($object->liste_contact(-1, 'external'), $object->liste_contact(-1, 'internal'));
-						}
 					}
 
 					foreach ($TContact as $i => $infos) {

htdocs/emailcollector/class/emailcollector.class.php

@@ -1539,7 +1539,7 @@ class EmailCollector extends CommonObject
 
 					// Make Operation
 					dol_syslog("Execute action ".$operation['type']." actionparam=".$operation['actionparam'].' thirdpartystatic->id='.$thirdpartystatic->id.' contactstatic->id='.$contactstatic->id.' projectstatic->id='.$projectstatic->id);
-					dol_syslog("Execute action fk_element_id=".$fk_element_id." fk_element_type=".$fk_element_type);
+					dol_syslog("Execute action fk_element_id=".$fk_element_id." fk_element_type=".$fk_element_type);	// If a Dolibarr tracker id is found, we should now the id of object
 
 					$actioncode = 'EMAIL_IN';
 					// If we scan the Sent box, we use the code for out email

htdocs/filefunc.inc.php

@@ -31,7 +31,7 @@
  */
 
 if (!defined('DOL_APPLICATION_TITLE')) define('DOL_APPLICATION_TITLE', 'Dolibarr');
-if (!defined('DOL_VERSION')) define('DOL_VERSION', '13.0.3'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c
+if (!defined('DOL_VERSION')) define('DOL_VERSION', '13.0.4'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c
 
 if (!defined('EURO')) define('EURO', chr(128));
 

htdocs/fourn/facture/card.php

@@ -1867,7 +1867,7 @@ if ($action == 'create')
 			// Type invoice
 			$facids = $facturestatic->list_replacable_supplier_invoices($societe->id);
 			if ($facids < 0) {
-				dol_print_error($db, $facturestatic);
+				dol_print_error($db, $facturestatic->error, $facturestatic->errors);
 				exit();
 			}
 			$options = "";
@@ -1933,7 +1933,7 @@ if ($action == 'create')
 				$facids = $facturestatic->list_qualified_avoir_supplier_invoices($societe->id);
 				if ($facids < 0)
 				{
-					dol_print_error($db, $facturestatic);
+					dol_print_error($db, $facturestatic->error, $facturestatic->errors);
 					exit;
 				}
 				$optionsav = "";

htdocs/fourn/facture/list.php

@@ -323,7 +323,7 @@ if (empty($reshook))
 					if ($numprlv > 0) {
 						$error++;
 						setEventMessages($objecttmp->ref.' '.$langs->trans("RequestAlreadyDone"), $objecttmp->errors, 'warnings');
-					} elseif (!empty($objecttmp->mode_reglement_code) && $objecttmp->mode_reglement_code != 'PRE') {
+					} elseif (!empty($objecttmp->mode_reglement_code) && $objecttmp->mode_reglement_code != 'VIR') {
 						$error++;
 						setEventMessages($objecttmp->ref.' '.$langs->trans("BadPaymentMethod"), $objecttmp->errors, 'errors');
 					} else {

htdocs/holiday/list.php

@@ -383,7 +383,7 @@ if ($resql)
 		//'builddoc'=>$langs->trans("PDFMerge"),
 		//'presend'=>$langs->trans("SendByMail"),
 	);
-	if ($user->rights->holiday->supprimer) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete");
+	if ($user->rights->holiday->delete) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete");
 	if (in_array($massaction, array('presend', 'predelete'))) $arrayofmassactions = array();
 	$massactionbutton = $form->selectMassAction('', $arrayofmassactions);
 

htdocs/langs/en_US/main.lang

@@ -1117,3 +1117,4 @@ UpdateForAllLines=Update for all lines
 OnHold=On hold
 Civility=Civility
 InformationOnLinkToContract=This amount is only the total of all the lines of the contract. No notion of time is taken into consideration.
+EmailMsgID=Email MsgID

htdocs/main.inc.php

@@ -413,15 +413,17 @@ if ((!empty($conf->global->MAIN_VERSION_LAST_UPGRADE) && ($conf->global->MAIN_VE
 }
 
 // Creation of a token against CSRF vulnerabilities
-if (!defined('NOTOKENRENEWAL'))
+if (!defined('NOTOKENRENEWAL')) {
-{
+	// No token renewal on .css.php, .js.php and .json.php
-	// Rolling token at each call ($_SESSION['token'] contains token of previous page)
+	if (!preg_match('/\.(css|js|json)\.php$/', $_SERVER["PHP_SELF"])) {
-	if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];
+		// Rolling token at each call ($_SESSION['token'] contains token of previous page)
+		if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];
 
-	// Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = $_SESSION['newtoken']
+		// Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = $_SESSION['newtoken']
-	$token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number
+		$token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number
-	$_SESSION['newtoken'] = $token;
+		$_SESSION['newtoken'] = $token;
-	dol_syslog("NEW TOKEN reclaimed by : " . $_SERVER['PHP_SELF'], LOG_DEBUG);
+		dol_syslog("NEW TOKEN generated by : " . $_SERVER['PHP_SELF'], LOG_DEBUG);
+	}
 }
 
 //dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha').' '.$_SESSION['token']);

htdocs/product/canvas/product/tpl/card_create.tpl.php

@@ -40,7 +40,7 @@ print dol_get_fiche_head('');
 <?php dol_htmloutput_errors($GLOBALS['mesg'], $GLOBALS['mesgs']); ?>
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="post">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="add">
 <input type="hidden" name="type" value="0">
 <input type="hidden" name="canvas" value="<?php echo $canvas; ?>">

htdocs/product/canvas/product/tpl/card_edit.tpl.php

@@ -39,7 +39,7 @@ dol_htmloutput_errors($object->error, $object->errors);
 ?>
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="post">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="update">
 <input type="hidden" name="id" value="<?php echo $object->id; ?>">
 <input type="hidden" name="canvas" value="<?php echo $object->canvas; ?>">

htdocs/product/canvas/service/tpl/card_create.tpl.php

@@ -40,7 +40,7 @@ print dol_get_fiche_head('');
 <?php dol_htmloutput_errors($GLOBALS['mesg'], $GLOBALS['mesgs']); ?>
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="post">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="add">
 <input type="hidden" name="type" value="1">
 <input type="hidden" name="canvas" value="<?php echo $canvas; ?>">

htdocs/product/canvas/service/tpl/card_edit.tpl.php

@@ -39,7 +39,7 @@ dol_htmloutput_errors($object->error, $object->errors);
 ?>
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="post">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="action" value="update">
 <input type="hidden" name="id" value="<?php echo $object->id; ?>">
 <input type="hidden" name="canvas" value="<?php echo $object->canvas; ?>">

htdocs/product/price.php

@@ -349,6 +349,7 @@ if (empty($reshook))
 
 				$newprice = price2num($newprice, 'MU');
 				$newprice_min = price2num($val['price_min'], 'MU');
+				$newvattx = price2num($val['vat_tx']);
 
 				if (!empty($conf->global->PRODUCT_MINIMUM_RECOMMENDED_PRICE) && $newprice_min < $maxpricesupplier) {
 					setEventMessages($langs->trans("MinimumPriceLimit", price($maxpricesupplier, 0, '', 1, - 1, - 1, 'auto')), null, 'errors');
@@ -356,10 +357,11 @@ if (empty($reshook))
 					break;
 				}
 
-				if ($object->multiprices[$key] != $newprice || $object->multiprices_min[$key] != $newprice_min || $object->multiprices_base_type[$key] != $val['price_base_type'])
+				if ($object->multiprices[$key] != $newprice || $object->multiprices_min[$key] != $newprice_min || $object->multiprices_base_type[$key] != $val['price_base_type'] || $object->multiprices_tva_tx[$key] != $newvattx) {
 	   				$res = $object->updatePrice($newprice, $val['price_base_type'], $user, $val['vat_tx'], $newprice_min, $key, $val['npr'], $psq, 0, $val['localtaxes_array'], $val['default_vat_code']);
-				else $res = 0;
+				} else {
-
+					$res = 0;
+				}
 
 				if ($res < 0) {
 					$error++;

htdocs/product/stock/replenish.php

@@ -368,6 +368,11 @@ if (!empty($conf->variants->eabled) && empty($conf->global->VARIANT_ALLOW_STOCK_
 if ($fk_supplier > 0) {
 	$sql .= ' AND EXISTS (SELECT pfp.rowid FROM '.MAIN_DB_PREFIX.'product_fournisseur_price as pfp WHERE pfp.fk_product = p.rowid AND pfp.fk_soc = '.((int) $fk_supplier).' AND pfp.entity IN ('.getEntity('product_fournisseur_price').'))';
 }
+// Add where from hooks
+$parameters = array();
+$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters); // Note that $action and $object may have been modified by hook
+$sql .= $hookmanager->resPrint;
+
 $sql .= ' GROUP BY p.rowid, p.ref, p.label, p.description, p.price';
 $sql .= ', p.price_ttc, p.price_base_type,p.fk_product_type, p.tms';
 $sql .= ', p.duration, p.tobuy';

htdocs/projet/activity/perday.php

@@ -207,7 +207,7 @@ if ($action == 'addtime' && $user->rights->projet->lire && GETPOST('assigntask')
 		{
 			// Test if we are already contact of the project (should be rare but sometimes we can add as task contact without being contact of project, like when admin user has been removed from contact of project)
 			$sql = 'SELECT ec.rowid FROM '.MAIN_DB_PREFIX.'element_contact as ec, '.MAIN_DB_PREFIX.'c_type_contact as tc WHERE tc.rowid = ec.fk_c_type_contact';
-			$sql .= ' AND ec.fk_socpeople = '.$idfortaskuser." AND ec.element_id = '.$object->fk_project.' AND tc.element = 'project' AND source = 'internal'";
+			$sql .= ' AND ec.fk_socpeople = '.((int) $idfortaskuser)." AND ec.element_id = ".((int) $object->fk_project)." AND tc.element = 'project' AND source = 'internal'";
 			$resql = $db->query($sql);
 			if ($resql)
 			{

htdocs/projet/activity/permonth.php

@@ -164,7 +164,7 @@ if ($action == 'addtime' && $user->rights->projet->lire && GETPOST('assigntask')
 		{
 			// Test if we are already contact of the project (should be rare but sometimes we can add as task contact without being contact of project, like when admin user has been removed from contact of project)
 			$sql = 'SELECT ec.rowid FROM '.MAIN_DB_PREFIX.'element_contact as ec, '.MAIN_DB_PREFIX.'c_type_contact as tc WHERE tc.rowid = ec.fk_c_type_contact';
-			$sql .= ' AND ec.fk_socpeople = '.$idfortaskuser." AND ec.element_id = '.$object->fk_project.' AND tc.element = 'project' AND source = 'internal'";
+			$sql .= ' AND ec.fk_socpeople = '.((int) $idfortaskuser)." AND ec.element_id = ".((int) $object->fk_project)." AND tc.element = 'project' AND source = 'internal'";
 			$resql = $db->query($sql);
 			if ($resql)
 			{

htdocs/projet/activity/perweek.php

@@ -220,7 +220,7 @@ if ($action == 'addtime' && $user->rights->projet->lire && GETPOST('assigntask')
 		{
 			// Test if we are already contact of the project (should be rare but sometimes we can add as task contact without being contact of project, like when admin user has been removed from contact of project)
 			$sql = 'SELECT ec.rowid FROM '.MAIN_DB_PREFIX.'element_contact as ec, '.MAIN_DB_PREFIX.'c_type_contact as tc WHERE tc.rowid = ec.fk_c_type_contact';
-			$sql .= ' AND ec.fk_socpeople = '.$idfortaskuser." AND ec.element_id = '.$object->fk_project.' AND tc.element = 'project' AND source = 'internal'";
+			$sql .= ' AND ec.fk_socpeople = '.((int) $idfortaskuser)." AND ec.element_id = ".((int) $object->fk_project)." AND tc.element = 'project' AND source = 'internal'";
 			$resql = $db->query($sql);
 			if ($resql)
 			{

htdocs/projet/class/project.class.php

@@ -206,6 +206,7 @@ class Project extends CommonObject
 		'fk_user_creat' =>array('type'=>'integer', 'label'=>'UserCreation', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>210),
 		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModification', 'enabled'=>1, 'visible'=>0, 'position'=>215),
 		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>220),
+		'email_msgid'=>array('type'=>'varchar(255)', 'label'=>'EmailMsgID', 'enabled'=>1, 'visible'=>-1, 'position'=>250, 'help'=>'EmailMsgIDWhenSourceisEmail'),
 		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500)
 	);
 	// END MODULEBUILDER PROPERTIES
@@ -525,7 +526,9 @@ class Project extends CommonObject
 	{
 		global $conf;
 
-		if (empty($id) && empty($ref)) return -1;
+		if (empty($id) && empty($ref) && empty($ref_ext) && empty($email_msgid)) {
+			return -1;
+		}
 
 		$sql = "SELECT rowid, entity, ref, title, description, public, datec, opp_amount, budget_amount,";
 		$sql .= " tms, dateo, datee, date_close, fk_soc, fk_user_creat, fk_user_modif, fk_user_close, fk_statut as status, fk_opp_status, opp_percent,";

htdocs/projet/list.php

@@ -25,7 +25,7 @@
 
 /**
  *	\file       htdocs/projet/list.php
- *	\ingroup    projet
+ *	\ingroup    project
  *	\brief      Page to list projects
  */
 
@@ -300,6 +300,7 @@ if (count($listofprojectcontacttype) == 0) $listofprojectcontacttype[0] = '0'; /
 $distinct = 'DISTINCT'; // We add distinct until we are added a protection to be sure a contact of a project and task is only once.
 $sql = "SELECT ".$distinct." p.rowid as id, p.ref, p.title, p.fk_statut as status, p.fk_opp_status, p.public, p.fk_user_creat";
 $sql .= ", p.datec as date_creation, p.dateo as date_start, p.datee as date_end, p.opp_amount, p.opp_percent, (p.opp_amount*p.opp_percent/100) as opp_weighted_amount, p.tms as date_update, p.budget_amount, p.usage_opportunity, p.usage_task, p.usage_bill_time";
+$sql .= ", p.email_msgid";
 $sql .= ", s.rowid as socid, s.nom as name, s.email";
 $sql .= ", cls.code as opp_status_code";
 // Add fields from extrafields
@@ -668,6 +669,12 @@ if (!empty($arrayfields['p.tms']['checked']))
 	print '<td class="liste_titre">';
 	print '</td>';
 }
+if (!empty($arrayfields['p.email_msgid']['checked']))
+{
+	// Email msg id
+	print '<td class="liste_titre">';
+	print '</td>';
+}
 if (!empty($arrayfields['p.fk_statut']['checked']))
 {
 	print '<td class="liste_titre nowrap right">';
@@ -710,6 +717,7 @@ $reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters); // No
 print $hookmanager->resPrint;
 if (!empty($arrayfields['p.datec']['checked']))  print_liste_field_titre($arrayfields['p.datec']['label'], $_SERVER["PHP_SELF"], "p.datec", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 if (!empty($arrayfields['p.tms']['checked']))    print_liste_field_titre($arrayfields['p.tms']['label'], $_SERVER["PHP_SELF"], "p.tms", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+if (!empty($arrayfields['p.email_msgid']['checked']))    print_liste_field_titre($arrayfields['p.email_msgid']['label'], $_SERVER["PHP_SELF"], "p.email_msgid", "", $param, '', $sortfield, $sortorder, 'center ');
 if (!empty($arrayfields['p.fk_statut']['checked'])) print_liste_field_titre($arrayfields['p.fk_statut']['label'], $_SERVER["PHP_SELF"], "p.fk_statut", "", $param, '', $sortfield, $sortorder, 'right ');
 print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ');
 print "</tr>\n";
@@ -948,6 +956,14 @@ while ($i < min($num, $limit))
 			print '</td>';
 			if (!$i) $totalarray['nbfield']++;
 		}
+		// Email MsgID
+		if (!empty($arrayfields['p.email_msgid']['checked']))
+		{
+			print '<td class="center">';
+			print $obj->email_msgid;
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
 		// Status
 		if (!empty($arrayfields['p.fk_statut']['checked']))
 		{

htdocs/public/members/new.php

@@ -119,14 +119,18 @@ function llxHeaderVierge($title, $head = "", $disablejs = 0, $disablehead = 0, $
 	if ($urllogo) {
 		print '<div class="backgreypublicpayment">';
 		print '<div class="logopublicpayment">';
-		print '<img id="dolpaymentlogo" src="'.$urllogo.'"';
+		print '<img id="dolpaymentlogo" src="'.$urllogo.'">';
-		print '>';
 		print '</div>';
 		if (empty($conf->global->MAIN_HIDE_POWERED_BY)) {
 			print '<div class="poweredbypublicpayment opacitymedium right"><a class="poweredbyhref" href="https://www.dolibarr.org?utm_medium=website&utm_source=poweredby" target="dolibarr" rel="noopener">'.$langs->trans("PoweredBy").'<br><img class="poweredbyimg" src="'.DOL_URL_ROOT.'/theme/dolibarr_logo.svg" width="80px"></a></div>';
 		}
 		print '</div>';
 	}
+	if (!empty($conf->global->MEMBER_IMAGE_PUBLIC_REGISTRATION)) {
+		print '<div class="backimagepublicregistration">';
+		print '<img id="dolpaymentlogo" src="'.$conf->global->MEMBER_IMAGE_PUBLIC_REGISTRATION.'">';
+		print '</div>';
+	}
 	print '</div>';
 
 	print '<div class="divmainbodylarge">';

htdocs/public/onlinesign/newonlinesign.php

@@ -189,6 +189,11 @@ if ($urllogo)
 	}
 	print '</div>';
 }
+if (!empty($conf->global->PROPOSAL_IMAGE_PUBLIC_SIGN)) {
+	print '<div class="backimagepublicproposalsign">';
+	print '<img id="dolpaymentlogo" src="'.$conf->global->PROPOSAL_IMAGE_PUBLIC_SIGN.'">';
+	print '</div>';
+}
 
 // Output introduction text
 $text = '';

htdocs/public/payment/newpayment.php

@@ -792,6 +792,11 @@ if ($urllogo)
 	}
 	print '</div>';
 }
+if (!empty($conf->global->MAIN_IMAGE_PUBLIC_PAYMENT)) {
+	print '<div class="backimagepublicpayment">';
+	print '<img id="dolpaymentlogo" src="'.$conf->global->MAIN_IMAGE_PUBLIC_PAYMENT.'">';
+	print '</div>';
+}
 
 
 

htdocs/public/payment/paymentko.php

@@ -242,6 +242,11 @@ if ($urllogo)
 	}
 	print '</div>';
 }
+if (!empty($conf->global->MAIN_IMAGE_PUBLIC_PAYMENT)) {
+	print '<div class="backimagepublicpayment">';
+	print '<img id="dolpaymentlogo" src="'.$conf->global->MAIN_IMAGE_PUBLIC_PAYMENT.'">';
+	print '</div>';
+}
 
 
 print '<br><br>';

htdocs/public/payment/paymentok.php

@@ -182,6 +182,11 @@ if ($urllogo)
 	}
 	print '</div>';
 }
+if (!empty($conf->global->MAIN_IMAGE_PUBLIC_PAYMENT)) {
+	print '<div class="backimagepublicpayment">';
+	print '<img id="dolpaymentlogo" src="'.$conf->global->MAIN_IMAGE_PUBLIC_PAYMENT.'">';
+	print '</div>';
+}
 
 
 print '<br><br><br>';

htdocs/public/recruitment/view.php

@@ -216,6 +216,11 @@ if ($urllogo)
 	}
 	print '</div>';
 }
+if (!empty($conf->global->RECRUITMENT_IMAGE_PUBLIC_PAYMENT)) {
+	print '<div class="backimagepublicrecruitment">';
+	print '<img id="dolpaymentlogo" src="'.$conf->global->RECRUITMENT_IMAGE_PUBLIC_PAYMENT.'">';
+	print '</div>';
+}
 
 // Output introduction text
 $text = '';

htdocs/societe/admin/societe.php

@@ -693,7 +693,7 @@ foreach ($profid as $key => $val)
 			print img_picto($langs->trans("Activated"), 'switch_on');
 			print '</a></td>';
 		} else {
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandator&token='.newToken().'&value='.$key.'&status=1">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandatory&token='.newToken().'&value='.$key.'&status=1">';
 			print img_picto($langs->trans("Disabled"), 'switch_off');
 			print '</a></td>';
 		}

htdocs/societe/class/societe.class.php

@@ -88,7 +88,7 @@ class Societe extends CommonObject
 
 	/**
 	 * @var array    List of child tables. To know object to delete on cascade.
-	 *               if name like with @ClassNAme:FilePathClass;ParentFkFieldName' it will call method deleteByParentField (with parentId as parameters) and FieldName to fetch and delete child object
+	 *               if name like with @ClassName:FilePathClass:ParentFkFieldName' it will call method deleteByParentField (with parentId as parameters) and FieldName to fetch and delete child object
 	 */
 	protected $childtablesoncascade = array(
 		"societe_prices",

htdocs/ticket/card.php

@@ -1305,10 +1305,14 @@ elseif (empty($action) || $action == 'view' || $action == 'addlink' || $action =
 			$newlang = '';
 			if ($conf->global->MAIN_MULTILANGS && empty($newlang) && GETPOST('lang_id', 'aZ09')) {
 				$newlang = GETPOST('lang_id', 'aZ09');
-			}
+			} elseif ($conf->global->MAIN_MULTILANGS && empty($newlang) && is_object($object->thirdparty)) {
-			if ($conf->global->MAIN_MULTILANGS && empty($newlang) && is_object($object->thirdparty)) {
 				$newlang = $object->thirdparty->default_lang;
 			}
+			if (!empty($newlang)) {
+				$outputlangs = new Translate("", $conf);
+				$outputlangs->setDefaultLang($newlang);
+			}
+
 			$arrayoffamiliestoexclude = array('objectamount');
 
 			$action = 'add_message'; // action to use to post the message
@@ -1317,7 +1321,7 @@ elseif (empty($action) || $action == 'view' || $action == 'addlink' || $action =
 			// Substitution array
 			$morehtmlright = '';
 			$help = "";
-			$substitutionarray = getCommonSubstitutionArray($newlang, 0, $arrayoffamiliestoexclude, $object);
+			$substitutionarray = getCommonSubstitutionArray($outputlangs, 0, $arrayoffamiliestoexclude, $object);
 			if ($object->fk_soc > 0) {
 				$substitutionarray['__THIRDPARTY_NAME__'] = $object->thirdparty->name;
 			}

htdocs/ticket/class/actions_ticket.class.php

@@ -191,7 +191,7 @@ class ActionsTicket
 
 		// Initial message
 		print '<div class="underbanner clearboth"></div>';
-		print '<div class="div-table-responsive-no-min">'; // You can use div-table-responsive-no-min if you dont need reserved height for your table
+		print '<div class="div-table-responsive-no-min" style="max-width: 70vw">'; // You can use div-table-responsive-no-min if you dont need reserved height for your table
 		print '<table class="noborder centpercent margintable">';
 		print '<tr class="liste_titre trforfield"><td class="nowrap titlefield">';
 		print $langs->trans("InitialMessage");

htdocs/ticket/class/ticket.class.php

@@ -529,7 +529,7 @@ class Ticket extends CommonObject
 		global $langs;
 
 		// Check parameters
-		if (!$id && !$track_id && !$ref && !$email_msgid) {
+		if (empty($id) && empty($ref) && empty($track_id) && empty($email_msgid)) {
 			$this->error = 'ErrorWrongParameters';
 			dol_print_error(get_class($this)."::fetch ".$this->error);
 			return -1;

htdocs/user/card.php

@@ -99,7 +99,7 @@ $result = restrictedArea($user, 'user', $id, 'user', $feature2);
 if ($user->id <> $id && !$canreaduser) accessforbidden();
 
 // Load translation files required by page
-$langs->loadLangs(array('users', 'companies', 'ldap', 'admin', 'hrm', 'stocks'));
+$langs->loadLangs(array('users', 'companies', 'ldap', 'admin', 'hrm', 'stocks', 'other'));
 
 $object = new User($db);
 $extrafields = new ExtraFields($db);