From f8e156ea3077eddbd9bfce237c947e5b7217b6c1 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Tue, 29 Dec 2015 10:35:10 +0100 Subject: [PATCH 1/9] FIX: Email templates not compatible with Multicompany --- htdocs/admin/dict.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index ae8ce969f70..19889157c28 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -9,6 +9,7 @@ * Copyright (C) 2012-2015 Marcos García * Copyright (C) 2012 Christophe Battarel * Copyright (C) 2011-2014 Alexandre Spangaro + * Copyright (C) 2015 Ferran Marcet * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -154,7 +155,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates"; +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".$conf->entity; // Criteria to sort dictionaries $tabsqlsort=array(); @@ -266,7 +267,7 @@ $tabfieldinsert[21]= "code,label"; $tabfieldinsert[22]= "code,label"; $tabfieldinsert[23]= "fk_pays,taux,accountancy_code_sell,accountancy_code_buy,note"; $tabfieldinsert[24]= "code,label"; -$tabfieldinsert[25]= "label,type_template,private,position,topic,content"; +$tabfieldinsert[25]= "label,type_template,private,position,topic,content,entity"; // Nom du rowid si le champ n'est pas de type autoincrement // Example: "" if id field is "rowid" and has autoincrement on From cebb996120064713c6a8975e0282883b7bfbacb7 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Tue, 29 Dec 2015 11:22:18 +0100 Subject: [PATCH 2/9] FIX: Email templates not compatible with Multicompany --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 19889157c28..81aa225cdfd 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -155,7 +155,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".$conf->entity; +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".getEntity('email_template',1); // Criteria to sort dictionaries $tabsqlsort=array(); From cafe148f7278be9e7ca0abec6ab6cf1e65ea0d36 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Mon, 4 Jan 2016 09:12:27 +0100 Subject: [PATCH 3/9] FIX: Email templates not compatible with Multicompany --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 81aa225cdfd..075ee355374 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -155,7 +155,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".getEntity('email_template',1); +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN ".getEntity('email_template',1); // Criteria to sort dictionaries $tabsqlsort=array(); From d8360a2a0169886c3c9be771202be480db12b534 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Thu, 7 Jan 2016 08:18:36 +0100 Subject: [PATCH 4/9] FIX: Email templates not compatible with Multicompany --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 075ee355374..78da22a8005 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -155,7 +155,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN ".getEntity('email_template',1); +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN (".getEntity('email_template',1).")"; // Criteria to sort dictionaries $tabsqlsort=array(); From f2178f0369981dce326e4d67e44ae7493539d550 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Fri, 8 Jan 2016 06:42:28 +0100 Subject: [PATCH 5/9] FIX #4291 Correctly filter external calendar GETPOSTs --- htdocs/admin/agenda_extsites.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/htdocs/admin/agenda_extsites.php b/htdocs/admin/agenda_extsites.php index 371854410b0..375d0af3adf 100644 --- a/htdocs/admin/agenda_extsites.php +++ b/htdocs/admin/agenda_extsites.php @@ -1,6 +1,7 @@ - * Copyright (C) 2011-2014 Juanjo Menent +/* Copyright (C) 2008-2011 Laurent Destailleur + * Copyright (C) 2011-2014 Juanjo Menent + * Copyright (C) 2016 Raphaël Doursenaud * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -88,7 +89,7 @@ if ($actionsave) // Save nb of agenda if (! $error) { - $res=dolibarr_set_const($db,'AGENDA_EXT_NB',trim(GETPOST('AGENDA_EXT_NB','alpha')),'chaine',0,'',$conf->entity); + $res=dolibarr_set_const($db,'AGENDA_EXT_NB',trim(GETPOST('AGENDA_EXT_NB','int')),'chaine',0,'',$conf->entity); if (! $res > 0) $error++; if (empty($conf->global->AGENDA_EXT_NB)) $conf->global->AGENDA_EXT_NB=5; $MAXAGENDA=empty($conf->global->AGENDA_EXT_NB)?5:$conf->global->AGENDA_EXT_NB; @@ -201,9 +202,9 @@ while ($i <= $MAXAGENDA) // Nb print ''.$langs->trans("AgendaExtNb",$key).""; // Name - print ''; + print ''; // URL - print ''; + print ''; // Color (Possible colors are limited by Google) print ''; //print $formadmin->selectColor($conf->global->$color, "google_agenda_color".$key, $colorlist); From 36dc8b1ce79c972c867b804778c5b780caea8a56 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 8 Jan 2016 13:57:53 +0100 Subject: [PATCH 6/9] FIX #4341 --- htdocs/main.inc.php | 1 + 1 file changed, 1 insertion(+) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index b45d672b385..b3040cbf03b 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -96,6 +96,7 @@ function test_sql_and_script_inject($val, $type) $sql_inj += preg_match('/