Merge remote-tracking branch 'upstream/develop' into actioncomm_category

ChangeLog

@@ -207,6 +207,29 @@ Following changes may create regressions for some external modules, but were nec
 * The jquery plugin/dependency multiselect has been removed. It was not used by Dolibarr core.
 
 
+***** ChangeLog for 10.0.4 compared to 10.0.3 *****
+FIX: The pdf templates were using the large logo making PDF too large (and edition of proposal, order, invoice VERY slow)
+FIX: #12258
+FIX: #12319 Restore feature ACCOUNTANCY_AUTOFILL_ACCOUNT_WITH_GENERIC.
+FIX: #12356
+FIX: #12372
+FIX: #12385
+FIX: Advisory ID: usd20190053
+FIX: Advisory ID: usd20190067
+FIX: Avoid fatal error when creating thumb from PDF
+FIX: compatibility with Multicompany
+FIX: display job of contact list
+FIX: Extrafields missing in export of expense report
+FIX: Hook getAccessForbiddenMessage was missing parameters
+FIX: limit 20 prevent to see all products/services
+FIX: Search on leave request ref
+FIX: security check. A user can see holiday with link without permissions
+FIX: Set unpaid of expense report
+FIX: shipping extrafields line
+FIX: the SELECT examine more than MAX_JOIN_SIZE rows #12305
+FIX: triggers: directories read with opendir() never closed
+FIX: we need to be able to recalculate tva only if invoice not in accountancy
+FIX: wrong invoice id for fetchObjetctLinked
 
 ***** ChangeLog for 10.0.3 compared to 10.0.2 *****
 IMPORTANT : This version fixes a serious bug in saving the units of weight, size, surface and volume on product card.

dev/dolibarr_changes.txt

@@ -52,6 +52,21 @@ Replace call to serialize_val with no bugged value
 
 TCPDF:
 ------
+* Replace in tcpdf.php:
+
+            if (isset($this->imagekeys)) {
+                foreach($this->imagekeys as $file) {
+                    unlink($file);
+                }
+            }
+with
+
+            if (isset($this->imagekeys)) {
+                foreach($this->imagekeys as $file) {
+//                  unlink($file);
+                }
+            }
+
 * To avoid to have QRcode changed because generated with a random mask, replace
 define('QR_FIND_FROM_RANDOM', 2);
 with

htdocs/adherents/list.php

@@ -412,7 +412,7 @@ if ($user->rights->adherent->creer)
 
 print '<form method="POST" id="searchFormList" action="'.$_SERVER["PHP_SELF"].'">';
 if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
-print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+print '<input type="hidden" name="token" value="'.newToken().'">';
 print '<input type="hidden" name="formfilteraction" id="formfilteraction" value="list">';
 print '<input type="hidden" name="action" value="list">';
 print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';

htdocs/adherents/subscription.php

@@ -398,7 +398,7 @@ if ($user->rights->adherent->cotisation->creer && $action == 'subscription' && !
 
                 $moreinheader = 'X-Dolibarr-Info: send_an_email by adherents/subscription.php'."\r\n";
 
-                $result = $object->send_an_email($texttosend, $subjecttosend, $listofpaths, $listofnames, $listofmimes, "", "", 0, -1, '', $moreinheader);
+                $result = $object->send_an_email($texttosend, $subjecttosend, $listofpaths, $listofmimes, $listofnames, "", "", 0, -1, '', $moreinheader);
                 if ($result < 0)
                 {
                 	$errmsg = $object->error;

htdocs/admin/index.php

@@ -67,9 +67,12 @@ if (! empty($conf->global->MAIN_MOTD_SETUPPAGE))
     }
 }
 
+print '<span class="opacitymedium">';
 print $langs->trans("SetupDescription1");
 print $langs->trans("AreaForAdminOnly").' ';
-print $langs->trans("SetupDescription2", $langs->transnoentities("MenuCompanySetup"), $langs->transnoentities("Modules"))."<br><br>";
+print $langs->trans("SetupDescription2", $langs->transnoentities("MenuCompanySetup"), $langs->transnoentities("Modules"));
+print '</span>';
+print "<br><br>";
 
 print '<br>';
 

htdocs/api/class/api_setup.class.php

@@ -1327,6 +1327,20 @@ class Setup extends DolibarrApi
     	return $list;
     }
 
+    /**
+     * Get properties of company
+     *
+     * @url	GET /company
+     *
+     * @return  array|mixed Data without useless information
+     *
+     */
+    public function getCompany()
+    {
+        global $mysoc;
+
+        return $this->_cleanObjectDatas($mysoc);
+    }
 
     /**
      * Do a test of integrity for files and setup.

htdocs/bom/bom_card.php

@@ -146,6 +146,11 @@ if (empty($reshook))
 			$error++;
 		}
 
+		if ($object->fk_product == $idprod) {
+		    setEventMessages($langs->trans('TheProductXIsAlreadyTheProductToProduce'), null, 'errors');
+		    $error++;
+		}
+
 		if (!$error)
 		{
     		$bomline = new BOMLine($db);
@@ -693,7 +698,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 	    $urlsource = $_SERVER["PHP_SELF"]."?id=".$object->id;
 	    $genallowed = $user->rights->bom->read; // If you can read, you can build the PDF to read content
 	    $delallowed = $user->rights->bom->write; // If you can create/edit, you can remove a file on card
-	    print $formfile->showdocuments('bom', $objref, $filedir, $urlsource, $genallowed, $delallowed, $object->modelpdf, 1, 0, 0, 28, 0, '', '', '', $mysoc->default_lang);
+	    print $formfile->showdocuments('bom', $objref, $filedir, $urlsource, $genallowed, $delallowed, $object->modelpdf, 1, 0, 0, 28, 0, '', '', '', $langs->defaultlang);
 
 	    // Show links to link elements
 	    $linktoelem = $form->showLinkToObjectBlock($object, null, array('bom'));

htdocs/bom/class/bom.class.php

@@ -992,7 +992,7 @@ class BOM extends CommonObject
 /**
  * Class for BOMLine
  */
-class BOMLine extends CommonObject
+class BOMLine extends CommonObjectLine
 {
 	/**
 	 * @var string ID to identify managed object

htdocs/bom/tpl/objectline_create.tpl.php

@@ -6,7 +6,7 @@
  * Copyright (C) 2014		Florian Henry		<florian.henry@open-concept.pro>
  * Copyright (C) 2014       Raphaël Doursenaud  <rdoursenaud@gpcsolutions.fr>
  * Copyright (C) 2015-2016	Marcos García		<marcosgdf@gmail.com>
- * Copyright (C) 2018       Frédéric France         <frederic.france@netlogic.fr>
+ * Copyright (C) 2018-2019  Frédéric France         <frederic.france@netlogic.fr>
  * Copyright (C) 2018		Ferran Marcet		<fmarcet@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -52,7 +52,7 @@ print "<!-- BEGIN PHP TEMPLATE objectline_create.tpl.php -->\n";
 
 $nolinesbefore=(count($this->lines) == 0 || $forcetoshowtitlelines);
 if ($nolinesbefore) {
-    print '<tr class="liste_titre'.($nolinesbefore?'':' liste_titre_add_').' nodrag nodrop">';
+    print '<tr class="liste_titre nodrag nodrop">';
     if (! empty($conf->global->MAIN_VIEW_LINE_NUMBER)) {
         print '<td class="linecolnum center"></td>';
     }

htdocs/categories/class/categorie.class.php

@@ -1154,11 +1154,13 @@ class Categorie extends CommonObject
     // phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
 	/**
 	 *	For category id_categ and its childs available in this->cats, define property fullpath and fulllabel.
+	 *  It is called by get_full_arbo()
 	 *  This function is a memory scan only from $this->cats and $this->motherof, no database access must be done here.
 	 *
 	 * 	@param		int		$id_categ		id_categ entry to update
 	 * 	@param		int		$protection		Deep counter to avoid infinite loop
 	 *	@return		void
+	 *  @see get_full_arbo()
 	 */
     public function build_path_from_id_categ($id_categ, $protection = 1000)
     {

htdocs/categories/viewcat.php

@@ -372,7 +372,7 @@ if ($type == Categorie::TYPE_PRODUCT)
 			print '<table class="noborder centpercent">';
 			print '<tr class="liste_titre"><td>';
 			print $langs->trans("AddProductServiceIntoCategory").' &nbsp;';
-			print $form->select_produits('', 'elemid', '', 0, 0, -1, 2, '', 1);
+			$form->select_produits('', 'elemid', '', 0, 0, -1, 2, '', 1);
 			print '<input type="submit" class="button" value="'.$langs->trans("ClassifyInCategory").'"></td>';
 			print '</tr>';
 			print '</table>';

htdocs/comm/action/class/api_agendaevents.class.php

@@ -79,7 +79,7 @@ class AgendaEvents extends DolibarrApi
             throw new RestException(404, 'Agenda Events not found');
         }
 
-        if (! DolibarrApiAccess::$user->rights->agenda->allactions->read && $this->actioncomm->ownerid != DolibarrApiAccess::$user->id) {
+        if (! DolibarrApiAccess::$user->rights->agenda->allactions->read && $this->actioncomm->userownerid != DolibarrApiAccess::$user->id) {
             throw new RestException(401, "Insufficient rights to read event for owner id ".$request_data['userownerid'].' Your id is '.DolibarrApiAccess::$user->id);
         }
 

htdocs/comm/propal/card.php

@@ -1588,7 +1588,7 @@ if ($action == 'create')
 			});
 			</script>';
 		}
-		print ' <a href="'.DOL_URL_ROOT.'/societe/card.php?action=create&client=3&fournisseur=0&backtopage='.urlencode($_SERVER["PHP_SELF"].'?action=create').'"><span class="valignmiddle text-plus-circle">'.$langs->trans("AddThirdParty").'</span><span class="fa fa-plus-circle valignmiddle paddingleft"></span></a>';
+		print ' <a href="'.DOL_URL_ROOT.'/societe/card.php?action=create&client=3&fournisseur=0&backtopage='.urlencode($_SERVER["PHP_SELF"].'?action=create').'"><span class="fa fa-plus-circle valignmiddle paddingleft" title="'.$langs->trans("AddThirdParty").'"></span></a>';
 		print '</td>';
 	}
 	print '</tr>'."\n";
@@ -1675,7 +1675,7 @@ if ($action == 'create')
 		print '<tr>';
 		print '<td>'.$langs->trans("Project").'</td><td>';
 		$numprojet = $formproject->select_projects(($soc->id > 0 ? $soc->id : -1), $projectid, 'projectid', 0, 0, 1, 1);
-		print ' &nbsp; <a href="'.DOL_URL_ROOT.'/projet/card.php?socid='.$soc->id.'&action=create&status=1&backtopage='.urlencode($_SERVER["PHP_SELF"].'?action=create&socid='.$soc->id).'"><span class="valignmiddle text-plus-circle">'.$langs->trans("AddProject").'</span><span class="fa fa-plus-circle valignmiddle paddingleft"></span></a>';
+		print ' &nbsp; <a href="'.DOL_URL_ROOT.'/projet/card.php?socid='.$soc->id.'&action=create&status=1&backtopage='.urlencode($_SERVER["PHP_SELF"].'?action=create&socid='.$soc->id).'"><span class="fa fa-plus-circle valignmiddle paddingleft" title="'.$langs->trans("AddProject").'"></span></a>';
 		print '</td>';
 		print '</tr>';
 	}

htdocs/compta/bank/various_payment/document.php

@@ -99,7 +99,7 @@ if ($object->id)
 				//$morehtmlref.=$form->form_project($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->socid, $object->fk_project, 'projectid', 0, 0, 1, 1);
 				$morehtmlref.='<form method="post" action="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'">';
 				$morehtmlref.='<input type="hidden" name="action" value="classin">';
-				$morehtmlref.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$morehtmlref.='<input type="hidden" name="token" value="'.newToken().'">';
 				$morehtmlref.=$formproject->select_projects(0, $object->fk_project, 'projectid', $maxlength, 0, 1, 0, 1, 0, 0, '', 1);
 				$morehtmlref.='<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 				$morehtmlref.='</form>';

htdocs/compta/bank/various_payment/list.php

@@ -157,9 +157,7 @@ if ($result)
 	$newcardbutton = '';
 	if ($user->rights->banque->modifier)
 	{
-		$newcardbutton='<a class="butActionNew" href="'.DOL_URL_ROOT.'/compta/bank/various_payment/card.php?action=create"><span class="valignmiddle text-plus-circle">'.$langs->trans('MenuNewVariousPayment').'</span>';
+		$newcardbutton .= dolGetButtonTitle($langs->trans('MenuNewVariousPayment'), '', 'fa fa-plus-circle', DOL_URL_ROOT.'/compta/bank/various_payment/card.php?action=create');
-		$newcardbutton.= '<span class="fa fa-plus-circle valignmiddle"></span>';
-		$newcardbutton.= '</a>';
 	}
 
 	print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
@@ -306,7 +304,7 @@ if ($result)
 		}
 
 		// Debit
-		print "<td class=\"right\">";
+		print '<td class="nowrap right">';
 		if ($obj->sens == 0)
 		{
 			print price($obj->amount);
@@ -317,7 +315,7 @@ if ($result)
 		print "</td>";
 
 		// Credit
-		print "<td class=\"right\">";
+		print '<td class="nowrap right">';
 		if ($obj->sens == 1)
 		{
 			print price($obj->amount);
@@ -325,17 +323,16 @@ if ($result)
 		}
 		if (! $i) $totalarray['nbfield']++;
 		if (! $i) $totalarray['pos'][$totalarray['nbfield']]='total_cred';
-		print "</td>";
+		print '</td>' ;
+		print '<td></td>';
 
-		print "<td></td>";
+		if (! $i) $totalarray['nbfield']++;
+
+		print "</tr>\n";
 
 		$i++;
 	}
 
-	$colspan = 4;
-	if (!empty($conf->banque->enabled)) $colspan++;
-	if (!empty($conf->accounting->enabled)) $colspan++;
-
 	// Show total line
 	include DOL_DOCUMENT_ROOT.'/core/tpl/list_print_total.tpl.php';
 

htdocs/compta/charges/index.php

@@ -92,7 +92,7 @@ if ($sortorder) $param .= '&sortorder='.$sortorder;
 
 print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
 if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
-print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+print '<input type="hidden" name="token" value="'.newToken().'">';
 print '<input type="hidden" name="formfilteraction" id="formfilteraction" value="list">';
 print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
 print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';

htdocs/compta/facture/card.php

@@ -1387,7 +1387,7 @@ if (empty($reshook))
 								if (empty($amount)) continue;
 
 								$arraylist = array('amount' => 'FixAmount', 'variable' => 'VarAmount');
-								$descline = $langs->trans('Deposit');
+								$descline = '(DEPOSIT)';
 								//$descline.= ' - '.$langs->trans($arraylist[$typeamount]);
 								if ($typeamount == 'amount') {
 									$descline .= ' ('.price($valuedeposit, '', $langs, 0, - 1, - 1, (!empty($object->multicurrency_code) ? $object->multicurrency_code : $conf->currency)).')';

htdocs/compta/facture/invoicetemplate_list.php

@@ -317,7 +317,7 @@ if ($resql)
 
 	print '<form method="POST" id="searchFormList" action="'.$_SERVER["PHP_SELF"].'">';
 	if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
-	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+	print '<input type="hidden" name="token" value="'.newToken().'">';
 	print '<input type="hidden" name="formfilteraction" id="formfilteraction" value="list">';
 	print '<input type="hidden" name="action" value="list">';
 	print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
@@ -374,14 +374,14 @@ if ($resql)
 	{
 		// Payment term
 		print '<td class="liste_titre right">';
-		print $form->select_conditions_paiements($search_payment_term, 'search_payment_term', -1, 1, 1, 'maxwidth100');
+		$form->select_conditions_paiements($search_payment_term, 'search_payment_term', -1, 1, 1, 'maxwidth100');
 		print "</td>";
 	}
 	if (! empty($arrayfields['f.fk_mode_reglement']['checked']))
 	{
 		// Payment mode
 		print '<td class="liste_titre right">';
-		print $form->select_types_paiements($search_payment_mode, 'search_payment_mode', '', 0, 1, 1, 0, 1, 'maxwidth100');
+		$form->select_types_paiements($search_payment_mode, 'search_payment_mode', '', 0, 1, 1, 0, 1, 'maxwidth100');
 		print '</td>';
 	}
 	if (! empty($arrayfields['recurring']['checked']))
@@ -487,7 +487,7 @@ if ($resql)
 	// Extra fields
 	include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
 	if (! empty($arrayfields['status']['checked']))          print_liste_field_titre($arrayfields['status']['label'], $_SERVER['PHP_SELF'], "f.suspended,f.frequency", "", $param, 'align="center"', $sortfield, $sortorder);
-	print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', 'align="center"', $sortfield, $sortorder, 'nomaxwidthsearch ')."\n";
+	print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', 'align="center"', $sortfield, $sortorder, 'nomaxwidthsearch ');
 	print "</tr>\n";
 
 	if ($num > 0)
@@ -550,7 +550,7 @@ if ($resql)
 			if (! empty($arrayfields['f.fk_cond_reglement']['checked']))
 			{
 			    print '<td class="right">';
-			    print $form->form_conditions_reglement('', $objp->fk_cond_reglement, 'none');
+			    $form->form_conditions_reglement('', $objp->fk_cond_reglement, 'none');
 			    print '</td>'."\n";
 			    if (! $i) $totalarray['nbfield']++;
 			}
@@ -558,7 +558,7 @@ if ($resql)
 			if (! empty($arrayfields['f.fk_mode_reglement']['checked']))
 			{
 			    print '<td class="right">';
-			    print $form->form_modes_reglement('', $objp->fk_mode_reglement, 'none');
+			    $form->form_modes_reglement('', $objp->fk_mode_reglement, 'none');
 			    print '</td>'."\n";
 			    if (! $i) $totalarray['nbfield']++;
 			}

htdocs/compta/facture/list.php

@@ -637,7 +637,7 @@ if ($resql)
 	print '<form method="POST" name="searchFormList" action="'.$_SERVER["PHP_SELF"].'">'."\n";
 
 	if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
-	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+	print '<input type="hidden" name="token" value="'.newToken().'">';
 	print '<input type="hidden" name="formfilteraction" id="formfilteraction" value="list">';
 	print '<input type="hidden" name="action" value="list">';
 	print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';

htdocs/compta/prelevement/class/bonprelevement.class.php

@@ -1803,7 +1803,7 @@ class BonPrelevement extends CommonObject
 	 *	Write sender of request (me).
 	 *  Note: The tag PmtInf is opened here but closed into caller
 	 *
-	 *	@param	string	$configuration	conf
+	 *	@param	Conf	$configuration	conf
 	 *	@param	int     $ladate			Date
 	 *	@param	int		$nombre			0 or 1
 	 *	@param	float	$total			Total

htdocs/compta/sociales/list.php

@@ -171,9 +171,7 @@ if ($resql)
 	$newcardbutton = '';
 	if ($user->rights->tax->charges->creer)
 	{
-		$newcardbutton = '<a class="butActionNew" href="'.DOL_URL_ROOT.'/compta/sociales/card.php?action=create"><span class="valignmiddle text-plus-circle">'.$langs->trans('MenuNewSocialContribution').'</span>';
+		$newcardbutton .= dolGetButtonTitle($langs->trans('MenuNewSocialContribution'), '', 'fa fa-plus-circle', DOL_URL_ROOT.'/compta/sociales/card.php?action=create');
-		$newcardbutton .= '<span class="fa fa-plus-circle valignmiddle"></span>';
-		$newcardbutton .= '</a>';
 	}
 
 	print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
@@ -267,15 +265,16 @@ if ($resql)
 			print '<tr class="oddeven">';
 
 			// Ref
-			print '<td width="60">';
+			print "<td>".$chargesociale_static->getNomUrl(1, '20')."</td>\n";
-			print $chargesociale_static->getNomUrl(1, '20');
+			if (! $i) $totalarray['nbfield']++;
-			print '</td>';
 
 			// Label
-			print '<td>'.dol_trunc($obj->label, 42).'</td>';
+			print "<td>".dol_trunc($obj->label, 42)."</td>\n";
+			if (! $i) $totalarray['nbfield']++;
 
 			// Type
-			print '<td>'.$obj->type_label.'</td>';
+			print "<td>".$obj->type_label."</td>\n";
+			if (! $i) $totalarray['nbfield']++;
 
 			// Date end period
 			print '<td align="center">';
@@ -287,21 +286,26 @@ if ($resql)
 			{
 				print '&nbsp;';
 			}
-			print '</td>';
+			print "</td>\n";
+			if (! $i) $totalarray['nbfield']++;
 
 			// Amount
-			print '<td class="right" width="100">'.price($obj->amount).'</td>';
+			print '<td class="nowrap right">'.price($obj->amount).'</td>';
 			if (! $i) $totalarray['nbfield']++;
 			if (! $i) $totalarray['pos'][$totalarray['nbfield']]='totalttcfield';
 			$totalarray['val']['totalttcfield'] += $obj->amount;
 
 			// Due date
 			print '<td width="110" align="center">'.dol_print_date($db->jdate($obj->date_ech), 'day').'</td>';
+			if (! $i) $totalarray['nbfield']++;
 
 			print '<td class="nowrap right">'.$chargesociale_static->LibStatut($obj->paye, 5, $obj->alreadypayed).'</td>';
+			if (! $i) $totalarray['nbfield']++;
 
 			print '<td></td>';
 
+			if (! $i) $totalarray['nbfield']++;
+
 			print '</tr>';
 			$i++;
 		}

htdocs/compta/tva/index.php

@@ -40,6 +40,7 @@ $year = GETPOST("year", "int");
 if (empty($year))
 {
 	$year_current = strftime("%Y", dol_now());
+	if ($conf->global->SOCIETE_FISCAL_MONTH_START > date('m')) $year_current--;
 	$year_start = $year_current;
 } else {
 	$year_current = $year;

htdocs/contact/class/contact.class.php

@@ -1617,7 +1617,7 @@ class Contact extends CommonObject
 
 		$this->db->begin();
 
-		$sql = "DELETE FROM ".MAIN_DB_PREFIX."societe_contacts WHERE fk_soc=".$this->socid;
+		$sql = "DELETE FROM ".MAIN_DB_PREFIX."societe_contacts WHERE fk_soc=".$this->socid." AND fk_socpeople=".$this->id;;
 
 		dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG);
 		$result = $this->db->query($sql);

htdocs/contrat/class/contrat.class.php

@@ -1054,7 +1054,7 @@ class Contrat extends CommonObject
     			    if ($originforcontact == 'shipping')     // shipment and order share the same contacts. If creating from shipment we take data of order
     			    {
     			        require_once DOL_DOCUMENT_ROOT.'/expedition/class/expedition.class.php';
-    			        $exp = new Expedition($db);
+    			        $exp = new Expedition($this->db);
     			        $exp->fetch($this->origin_id);
     			        $exp->fetchObjectLinked();
     			        if (count($exp->linkedObjectsIds['commande']) > 0)

htdocs/core/boxes/box_graph_invoices_permonth.php

@@ -239,7 +239,7 @@ class box_graph_invoices_permonth extends ModeleBoxes
 					</script>';
 				$stringtoshow.='<div class="center hideobject" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 				$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-				$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 				$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 				$stringtoshow.='<input type="hidden" name="page_y" value="">';
 				$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,shownb,showtot">';

htdocs/core/boxes/box_graph_invoices_supplier_permonth.php

@@ -237,7 +237,7 @@ class box_graph_invoices_supplier_permonth extends ModeleBoxes
 					</script>';
 				$stringtoshow.='<div class="center hideobject" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 				$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-				$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 				$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 				$stringtoshow.='<input type="hidden" name="page_y" value="">';
 				$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,shownb,showtot">';

htdocs/core/boxes/box_graph_orders_permonth.php

@@ -236,7 +236,7 @@ class box_graph_orders_permonth extends ModeleBoxes
 					</script>';
 				$stringtoshow.='<div class="center hideobject" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 				$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-				$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 				$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 				$stringtoshow.='<input type="hidden" name="page_y" value="">';
 				$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,shownb,showtot">';

htdocs/core/boxes/box_graph_orders_supplier_permonth.php

@@ -235,7 +235,7 @@ class box_graph_orders_supplier_permonth extends ModeleBoxes
 					</script>';
 				$stringtoshow.='<div class="center hideobject" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 				$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-				$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 				$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 				$stringtoshow.='<input type="hidden" name="page_y" value="">';
 				$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,shownb,showtot">';

htdocs/core/boxes/box_graph_product_distribution.php

@@ -332,7 +332,7 @@ class box_graph_product_distribution extends ModeleBoxes
 			</script>';
 			$stringtoshow.='<div class="center hideobject" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 			$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-			$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 			$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 			$stringtoshow.='<input type="hidden" name="page_y" value="">';
 			$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,showinvoicenb,showpropalnb,showordernb">';

htdocs/core/boxes/box_graph_propales_permonth.php

@@ -236,7 +236,7 @@ class box_graph_propales_permonth extends ModeleBoxes
 					</script>';
 				$stringtoshow.='<div class="center hideobject divboxfilter" id="idfilter'.$this->boxcode.'">';	// hideobject is to start hidden
 				$stringtoshow.='<form class="flat formboxfilter" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
-				$stringtoshow.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$stringtoshow.='<input type="hidden" name="token" value="'.newToken().'">';
 				$stringtoshow.='<input type="hidden" name="action" value="'.$refreshaction.'">';
 				$stringtoshow.='<input type="hidden" name="page_y" value="">';
 				$stringtoshow.='<input type="hidden" name="DOL_AUTOSET_COOKIE" value="DOLUSERCOOKIE_box_'.$this->boxcode.':year,shownb,showtot">';

htdocs/core/boxes/box_task.php

@@ -121,7 +121,7 @@ class box_task extends ModeleBoxes
             $boxcontent.= '<div id="ancor-idfilter'.$this->boxcode.'" style="display: block; position: absolute; margin-top: -100px"></div>'."\n";
             $boxcontent.= '<div id="idfilter'.$this->boxcode.'" class="center" >'."\n";
             $boxcontent.= '<form class="flat " method="POST" action="'.$_SERVER["PHP_SELF"].'#ancor-idfilter'.$this->boxcode.'">'."\n";
-            $boxcontent.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'."\n";
+            $boxcontent.= '<input type="hidden" name="token" value="'.newToken().'">'."\n";
             $selectArray = array('all' => $langs->trans("NoFilter"), 'im_task_contact' => $langs->trans("WhichIamLinkedTo"), 'im_project_contact' => $langs->trans("WhichIamLinkedToProject"));
             $boxcontent.= $form->selectArray($cookie_name, $selectArray, $filterValue);
             $boxcontent.= '<button type="submit" class="button">'.$langs->trans("Refresh").'</button>';

htdocs/core/class/commonobject.class.php

@@ -7546,7 +7546,7 @@ abstract class CommonObject
 		{
 		    if (key_exists('ref', $this->fields) && $this->fields['ref']['notnull'] > 0 && !is_null($this->fields['ref']['default']) && $this->fields['ref']['default'] == '(PROV)')
 		    {
-		        $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ref = '(PROV".$this->id.")' WHERE ref = '(PROV)' AND rowid = ".$this->id;
+		        $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET ref = '(PROV".$this->id.")' WHERE (ref = '(PROV)' OR ref = '') AND rowid = ".$this->id;
 		        $resqlupdate = $this->db->query($sql);
 
 		        if ($resqlupdate === false)

htdocs/core/class/html.form.class.php

@@ -185,7 +185,7 @@ class Form
 				$ret .= "\n";
 				$ret .= '<form method="post" action="'.$_SERVER["PHP_SELF"].($moreparam ? '?'.$moreparam : '').'">';
 				$ret .= '<input type="hidden" name="action" value="set'.$htmlname.'">';
-				$ret .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$ret .= '<input type="hidden" name="token" value="'.newToken().'">';
 				$ret .= '<input type="hidden" name="'.$paramid.'" value="'.$object->id.'">';
 				if (empty($notabletag)) $ret .= '<table class="nobordernopadding centpercent" cellpadding="0" cellspacing="0">';
 				if (empty($notabletag)) $ret .= '<tr><td>';
@@ -825,7 +825,7 @@ class Form
 			{
 				$out .= '<form method="post" action="'.$page.'">';
 				$out .= '<input type="hidden" name="action" value="set_incoterms">';
-				$out .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+				$out .= '<input type="hidden" name="token" value="'.newToken().'">';
 			}
 
 			$out .= '<select id="'.$htmlname.'" class="flat selectincoterm minwidth100imp noenlargeonsmartphone" name="'.$htmlname.'" '.$htmloption.'>';
@@ -3642,7 +3642,7 @@ class Form
 		if ($htmlname != "none") {
 			print '<form method="POST" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setshippingmethod">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$this->selectShippingMethod($selected, $htmlname, '', $addempty);
 			print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -3918,7 +3918,7 @@ class Form
 		if ($htmlname != "none") {
 			print '<form method="POST" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setbankaccount">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$nbaccountfound = $this->select_comptes($selected, $htmlname, 0, '', $addempty);
 			if ($nbaccountfound > 0) print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -3971,7 +3971,7 @@ class Form
 		if ($type === Categorie::TYPE_BANK_LINE)
 		{
 			// TODO Move this into common category feature
-			$categids = array();
+			$cate_arbo = array();
 			$sql = "SELECT c.label, c.rowid";
 			$sql .= " FROM ".MAIN_DB_PREFIX."bank_categ as c";
 			$sql .= " WHERE entity = ".$conf->entity;
@@ -4256,7 +4256,7 @@ class Form
                     closeOnEscape: false,
                     buttons: {
                         "'.dol_escape_js($langs->transnoentities("Yes")).'": function() {
-                        	var options = "&token='.urlencode($_SESSION['newtoken']).'";
+                        	var options = "&token='.urlencode(newToken()).'";
                         	var inputok = '.json_encode($inputok).';
                          	var pageyes = "'.dol_escape_js(!empty($pageyes) ? $pageyes : '').'";
                          	if (inputok.length>0) {
@@ -4275,7 +4275,7 @@ class Form
                             $(this).dialog("close");
                         },
                         "'.dol_escape_js($langs->transnoentities("No")).'": function() {
-                        	var options = "&token='.urlencode($_SESSION['newtoken']).'";
+                        	var options = "&token='.urlencode(newToken()).'";
                          	var inputko = '.json_encode($inputko).';
                          	var pageno="'.dol_escape_js(!empty($pageno) ? $pageno : '').'";
                          	if (inputko.length>0) {
@@ -4314,7 +4314,7 @@ class Form
 			if (empty($disableformtag)) $formconfirm .= '<form method="POST" action="'.$page.'" class="notoptoleftroright">'."\n";
 
 			$formconfirm .= '<input type="hidden" name="action" value="'.$action.'">'."\n";
-			$formconfirm .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'."\n";
+			$formconfirm .= '<input type="hidden" name="token" value="'.newToken().'">'."\n";
 
 			$formconfirm .= '<table class="valid centpercent">'."\n";
 
@@ -4382,7 +4382,7 @@ class Form
 			$out .= "\n";
 			$out .= '<form method="post" action="'.$page.'">';
 			$out .= '<input type="hidden" name="action" value="classin">';
-			$out .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			$out .= '<input type="hidden" name="token" value="'.newToken().'">';
 			$out .= $formproject->select_projects($socid, $selected, $htmlname, $maxlength, 0, 1, $discard_closed, $forcefocus, 0, 0, '', 1);
 			$out .= '<input type="submit" class="button" value="'.$langs->trans("Modify").'">';
 			$out .= '</form>';
@@ -4428,7 +4428,7 @@ class Form
 		{
 			print '<form method="post" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setconditions">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$this->select_conditions_paiements($selected, $htmlname, -1, $addempty);
 			print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4463,7 +4463,7 @@ class Form
 		{
 			print '<form method="post" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setavailability">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$this->selectAvailabilityDelay($selected, $htmlname, -1, $addempty);
 			print '<input type="submit" class="button" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4497,7 +4497,7 @@ class Form
 		{
 			print '<form method="post" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setdemandreason">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$this->selectInputReason($selected, $htmlname, -1, $addempty);
 			print '<input type="submit" class="button" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4545,7 +4545,7 @@ class Form
 		{
 			$ret .= '<form method="post" action="'.$page.'" name="form'.$htmlname.'">';
 			$ret .= '<input type="hidden" name="action" value="set'.$htmlname.'">';
-			$ret .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			$ret .= '<input type="hidden" name="token" value="'.newToken().'">';
 			$ret .= '<table class="nobordernopadding" cellpadding="0" cellspacing="0">';
 			$ret .= '<tr><td>';
 			$ret .= $this->selectDate($selected, $htmlname, $displayhour, $displaymin, 1, 'form'.$htmlname, 1, 0);
@@ -4584,7 +4584,7 @@ class Form
 		{
 			print '<form method="POST" action="'.$page.'" name="form'.$htmlname.'">';
 			print '<input type="hidden" name="action" value="set'.$htmlname.'">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			print $this->select_dolusers($selected, $htmlname, 1, $exclude, 0, $include);
 			print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4624,7 +4624,7 @@ class Form
 		{
 			print '<form method="POST" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setmode">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			$this->select_types_paiements($selected, $htmlname, $filtertype, 0, $addempty, 0, 0, $active);
 			print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4658,7 +4658,7 @@ class Form
 		{
 			print '<form method="POST" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setmulticurrencycode">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			print $this->selectMultiCurrency($selected, $htmlname, 0);
 			print '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			print '</form>';
@@ -4689,7 +4689,7 @@ class Form
 		{
 			print '<form method="POST" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setmulticurrencyrate">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			print '<input type="text" name="'.$htmlname.'" value="'.(!empty($rate) ? price($rate) : 1).'" size="10" /> ';
 			print '<select name="calculation_mode">';
 			print '<option value="1">'.$currency.' > '.$conf->currency.'</option>';
@@ -4737,7 +4737,7 @@ class Form
 		{
 			print '<form method="post" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="setabsolutediscount">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			print '<div class="inline-block">';
 			if (!empty($discount_type)) {
 				if (!empty($conf->global->FACTURE_DEPOSITS_ARE_JUST_PAYMENTS))
@@ -4829,7 +4829,7 @@ class Form
 		{
 			print '<form method="post" action="'.$page.'">';
 			print '<input type="hidden" name="action" value="set_contact">';
-			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			print '<input type="hidden" name="token" value="'.newToken().'">';
 			print '<table class="nobordernopadding" cellpadding="0" cellspacing="0">';
 			print '<tr><td>';
 			$num = $this->select_contacts($societe->id, $selected, $htmlname);
@@ -4881,7 +4881,7 @@ class Form
 		{
 			$out .= '<form method="post" action="'.$page.'">';
 			$out .= '<input type="hidden" name="action" value="set_thirdparty">';
-			$out .= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+			$out .= '<input type="hidden" name="token" value="'.newToken().'">';
 			$out .= $this->select_company($selected, $htmlname, $filter, $showempty, $showtype, $forcecombo, $events);
 			$out .= '<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
 			$out .= '</form>';
@@ -6940,7 +6940,7 @@ class Form
 					print '<br>';
 					print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" name="formlinked'.$key.'">';
 					print '<input type="hidden" name="action" value="addlink">';
-					print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+					print '<input type="hidden" name="token" value="'.newToken().'">';
 					print '<input type="hidden" name="id" value="'.$object->id.'">';
 					print '<input type="hidden" name="addlink" value="'.$key.'">';
 					print '<table class="noborder">';

htdocs/core/class/html.formbarcode.class.php

@@ -90,7 +90,7 @@ class FormBarCode
         if (!empty($conf->use_javascript_ajax))
         {
             $select_encoder = '<form action="'.DOL_URL_ROOT.'/admin/barcode.php" method="POST" id="form'.$idForm.'">';
-            $select_encoder.= '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+            $select_encoder.= '<input type="hidden" name="token" value="'.newToken().'">';
             $select_encoder.= '<input type="hidden" name="action" value="update">';
             $select_encoder.= '<input type="hidden" name="code_id" value="'.$code_id.'">';
         }
@@ -213,7 +213,7 @@ class FormBarCode
         $out = '';
         if ($htmlname != "none") {
             $out .= '<form method="post" action="' . $page . '">';
-            $out .= '<input type="hidden" name="token" value="' . $_SESSION['newtoken'] . '">';
+            $out .= '<input type="hidden" name="token" value="' . newToken() . '">';
             $out .= '<input type="hidden" name="action" value="set'.$htmlname.'">';
             $out .= '<table class="nobordernopadding" cellpadding="0" cellspacing="0">';
             $out .= '<tr><td>';